Edit:
#!/usr/bin/perl
# chooser.cgi
# Outputs HTML for a frame-based file chooser
BEGIN { push(@INC, "."); };
use WebminCore;
@icon_map = ( "c", "text.gif",
"txt", "text.gif",
"pl", "text.gif",
"cgi", "text.gif",
"html", "text.gif",
"htm", "text.gif",
"php", "text.gif",
"php5", "text.gif",
"gif", "image.gif",
"jpg", "image.gif",
"jpeg", "image.gif",
"png", "image.gif",
"tar", "binary.gif"
);
&init_config();
if (&get_product_name() eq 'usermin') {
&switch_to_remote_user();
}
%access = &get_module_acl();
# Work out root directory
local @uinfo = getpwnam($remote_user);
if (!$access{'root'}) {
$rootdir = $uinfo[7] ? $uinfo[7] : "/";
}
else {
$rootdir = $access{'root'};
$rootdir =~ s/^\~/$uinfo[7]/;
}
# Switch to correct Unix user
if (&supports_users()) {
if (&get_product_name() eq 'usermin') {
# Always run as Usermin login
&switch_to_remote_user();
}
else {
# ACL determines
$fileunix = $access{'fileunix'} || $remote_user;
@uinfo = getpwnam($fileunix);
if (!@uinfo && !$access{'fileunix'}) {
@uinfo = getpwnam("nobody");
}
if (@uinfo) {
&switch_to_unix_user(\@uinfo);
}
}
}
&ReadParse(undef, undef, 1);
# If a chroot is forced which is under the allowed root, there is no need for
# a restrictred root
if ($in{'chroot'} && $in{'chroot'} ne '/' && $rootdir && $rootdir ne '/' &&
$in{'chroot'} =~ /^\Q$rootdir\E/) {
$rootdir = undef;
}
if ($gconfig{'os_type'} eq 'windows') {
# On Windows, chroot should be empty if not use, and default path
# should be c:/
if ($in{'chroot'} eq "/") {
$in{'chroot'} = "";
}
if ($rootdir eq "/") {
$rootdir = "c:";
}
}
if ($in{'add'}) {
# Only use last filename by default
$in{'file'} =~ s/\s+$//;
if ($in{'file'} =~ /\n(.*)$/) {
$in{'file'} = $1;
}
}
if ($in{'file'} =~ /^(([a-z]:)?.*\/)([^\/]*)$/i && $in{'file'} !~ /\.\./) {
# File entered is valid
$dir = $1;
$file = $3;
}
else {
# Fall back to default
$dir = $rootdir;
$dir .= '/' if ($dir !~ /\/$/);
$file = "";
}
$add = int($in{'add'});
if (!(-d $in{'chroot'}.$dir)) {
# Entered directory does not exist
$dir = $rootdir.'/';
$file = "";
}
if (!&allowed_dir($dir)) {
# Directory is outside allowed root
$dir = $rootdir.'/';
$file = "";
}
# Work out the top allowed dir
$topdir = $rootdir eq "/" || $rootdir eq "c:" ? $rootdir :
$access{'otherdirs'} ? "/" : $rootdir;
$uchroot = &urlize($in{'chroot'});
$utype = &urlize($in{'type'});
$ufile = &urlize($in{'file'});
if ($in{'frame'} == 0) {
# base frame
&PrintHeader();
if ($in{'type'} == 0) {
print "/usr/share/usermin/chooser.cgi (7387B)
]}/images/$icon)
");
push(@cols, "$link".&html_escape($f)."");
push(@cols, &nice_size($st[7]));
@tm = localtime($st[9]);
push(@cols, sprintf "%.2d/%s/%.4d",
$tm[3], $text{'smonth_'.($tm[4]+1)}, $tm[5]+1900);
push(@cols, sprintf "%.2d:%.2d", $tm[2], $tm[1]);
print &ui_columns_row(\@cols);
$cnt++;
}
closedir(DIR);
print &ui_columns_end();
if ( $cnt >= 10 ) {
print "";
print "";
}
&popup_footer();
}
elsif ($in{'frame'} == 2) {
# Current file and OK/cancel buttons
&popup_header();
print <