FM / filemin

/usr/share/usermin/filemin

Name	Size	Mode	Actions
images/	-	0755	rm
lang/	-	0755	rm
unauthenticated/	-	0755	rm
acl_security.pl	2571	0644	edit dl rm
bookmark.cgi	326	0755	edit dl rm
CHANGELOG	9440	0644	edit dl rm
chattr.cgi	1007	0755	edit dl rm
chcon.cgi	979	0755	edit dl rm
chmod.cgi	2475	0755	edit dl rm
chown.cgi	983	0755	edit dl rm
compress.cgi	1187	0755	edit dl rm
config	20	0644	edit dl rm
config.cgi	2581	0755	edit dl rm
config.info	260	0644	edit dl rm
config.info.ar	97	0644	edit dl rm
config.info.ca	52	0644	edit dl rm
config.info.de	61	0644	edit dl rm
config.info.fr	60	0644	edit dl rm
config.info.it	199	0644	edit dl rm
config.info.uk	260	0644	edit dl rm
copy.cgi	362	0755	edit dl rm
create_file.cgi	559	0755	edit dl rm
create_folder.cgi	550	0755	edit dl rm
cut.cgi	361	0755	edit dl rm
defaultacl	375	0644	edit dl rm
defaultuconf	180	0644	edit dl rm
delete.cgi	463	0755	edit dl rm
download.cgi	799	0755	edit dl rm
edit_file.cgi	1811	0755	edit dl rm
extract.cgi	1530	0755	edit dl rm
filemin-lib.pl	26357	0644	edit dl rm
http_download.cgi	1371	0755	edit dl rm
index.cgi	3522	0755	edit dl rm
module.info	137	0644	edit dl rm
module.info.ar	116	0644	edit dl rm
module.info.ar.auto	32	0644	edit dl rm
module.info.bg	0	0644	edit dl rm
module.info.bg.auto	164	0644	edit dl rm
module.info.ca	89	0644	edit dl rm
module.info.ca.auto	24	0644	edit dl rm
module.info.cs	0	0644	edit dl rm
module.info.cs.auto	115	0644	edit dl rm
module.info.da	0	0644	edit dl rm
module.info.da.auto	101	0644	edit dl rm
module.info.de	88	0644	edit dl rm
module.info.de.auto	21	0644	edit dl rm
module.info.el	0	0644	edit dl rm
module.info.el.auto	209	0644	edit dl rm
module.info.es	0	0644	edit dl rm
module.info.es.auto	140	0644	edit dl rm
module.info.eu	0	0644	edit dl rm
module.info.eu.auto	131	0644	edit dl rm
module.info.fa	0	0644	edit dl rm
module.info.fa.auto	137	0644	edit dl rm
module.info.fi	0	0644	edit dl rm
module.info.fi.auto	110	0644	edit dl rm
module.info.fr	0	0644	edit dl rm
module.info.fr.auto	136	0644	edit dl rm
module.info.hr	0	0644	edit dl rm
module.info.hr.auto	118	0644	edit dl rm
module.info.hu	0	0644	edit dl rm
module.info.hu.auto	109	0644	edit dl rm
module.info.it	104	0644	edit dl rm
module.info.ja	0	0644	edit dl rm
module.info.ja.auto	137	0644	edit dl rm
module.info.ko	0	0644	edit dl rm
module.info.ko.auto	118	0644	edit dl rm
module.info.ms	0	0644	edit dl rm
module.info.ms.auto	113	0644	edit dl rm
module.info.nl	0	0644	edit dl rm
module.info.nl.auto	108	0644	edit dl rm
module.info.no	22	0644	edit dl rm
module.info.no.auto	75	0644	edit dl rm
module.info.pl	96	0644	edit dl rm
module.info.pl.auto	115	0644	edit dl rm
module.info.pt	0	0644	edit dl rm
module.info.pt.auto	133	0644	edit dl rm
module.info.pt_BR	0	0644	edit dl rm
module.info.pt_BR.auto	142	0644	edit dl rm
module.info.ru	0	0644	edit dl rm
module.info.ru.auto	194	0644	edit dl rm
module.info.sk	0	0644	edit dl rm
module.info.sk.auto	126	0644	edit dl rm
module.info.sv	0	0644	edit dl rm
module.info.sv.auto	99	0644	edit dl rm
module.info.tr	0	0644	edit dl rm
module.info.tr.auto	121	0644	edit dl rm
module.info.uk	367	0644	edit dl rm
module.info.uk.auto	188	0644	edit dl rm
module.info.zh	0	0644	edit dl rm
module.info.zh.auto	101	0644	edit dl rm
module.info.zh_TW	0	0644	edit dl rm
module.info.zh_TW.auto	110	0644	edit dl rm
paste.cgi	1408	0755	edit dl rm
prefs.info	10	0644	edit dl rm
rename.cgi	545	0755	edit dl rm
safeacl	50	0644	edit dl rm
save_config.cgi	975	0755	edit dl rm
save_file.cgi	804	0755	edit dl rm
search.cgi	572	0755	edit dl rm
setfacl.cgi	1689	0755	edit dl rm
upload.cgi	5356	0755	edit dl rm

Edit: /usr/share/usermin/filemin/upload.cgi (5356B)

#!/usr/bin/perl

require './filemin-lib.pl';
use Cwd 'abs_path';

&ReadParse(\%in, "GET");

get_paths();

my @errors;
my @uploaded_files;
my $uploaded_dir;
$line = "";

# Use Webmin's callback function to track progress
$cbfunc = \&read_parse_mime_callback;

# Get multipart form boundary
$ENV{'CONTENT_TYPE'} =~ /boundary=(.*)$/ || &error($text{'readparse_enc'});
$boundary = $1;

# Initialize progress tracker
&$cbfunc(0, $ENV{'CONTENT_LENGTH'}, undef, $in{'id'});

#Read the data
MAINLOOP: while(index($line,"$boundary--") == -1) {
	# Reset vars on each loop
	$file = undef;
	$rest = undef;
	$prevline = undef;
	$header = undef;
	$line = <STDIN>;
	$got += length($line);
	if ($upload_max && $got > $upload_max) {
		&error(&text('error_upload_emax', &nice_size($upload_max)));
		}
  	&$cbfunc($got, $ENV{'CONTENT_LENGTH'}, undef, $in{'id'});
	if ($line =~ /(\S+):\s*form-data(.*)$/) {
		$rest = $2; # We found form data definition, let`s check it
		}
	else {
		next;
		}

# Check if current form data part is file
	while ($rest =~ /([a-zA-Z]*)=\"([^\"]*)\"(.*)/) {
		if ($1 eq 'filename') {
			$file = $2;
			}
		$rest = $3;
		}
    
	if (defined($file)) {
		my @st = stat($cwd);
		# If we have a dir, parse it and create a sub-tree first
		if ($file =~ /\//) {
			my ($dir) = $file =~ /^(.*)\/[^\/]+$/;
			if ($dir) {
				my @dirs = split('/', $dir);
				$dir = '/';
				# If overwriting is not allowed check for dupes
				if (!$in{'overwrite_existing'}) {
					if ($dirs[0] && -e "$cwd/$dirs[0]") {
						# As only one directory upload at a time allowed
						# check if parent exists and if it does add
						# predictable suffix, like `dir(1)` or `dir(2)`
						if (!$uploaded_dir) {
							my $__ = 1;
							for (;;) {
							    my $new_dir_name = "$dirs[0](" . $__++ . ")";
							    if (!-e "$cwd/$new_dir_name") {
									$uploaded_dir = $new_dir_name;
							        last;
							    	}
								}
							}
						}
					else {
						$uploaded_dir = $dirs[0];
						}
					$file =~ s/^(\Q$dirs[0]\E)/$uploaded_dir/;
					$dirs[0] = $uploaded_dir;
				}
				foreach my $updir (@dirs) {
					$dir .= "$updir/";
					if (!-e "$cwd$dir") {
						mkdir("$cwd$dir");
						&set_ownership_permissions($st[4], $st[5], undef, "$cwd$dir");
						}
					}
				}
			}
		# In case of a regular file check for dupes
		if (!$in{'overwrite_existing'}) {
			if ($file && -e "$cwd/$file") {
				# If file exists add predictable suffix, like `file(1)` or `file(2)`
				my ($file_name, $file_extension) = $file =~ /(?|(.*)\.((?|tar|wbm|wbt)\..*)|(.*)\.([a-zA-Z]+\.(?|gpg|pgp))|(.*)\.(?=(.*))|(.*)())/;
				$file_extension  = ".$file_extension" if ($file_extension);
				my $__ = 1;
				for (;;) {
					my $new_file_name = "$file_name(" . $__++ . ")";
					if (!-e "$cwd/$new_file_name$file_extension") {
						$file = "$new_file_name$file_extension";
						last;
						}
					}
				}
			}

# OK, we have a file, let`s save it
		my $full = "$cwd/$file";
		my $newfile = !-e $full;
		if (!open(OUTFILE, ">$full")) {
			push @errors, "$text{'error_opening_file_for_writing'} $path/$file - $!";
			next;        
			}
		else {
			binmode(OUTFILE);
			if ($newfile) {
				# Copy ownership from parent dir
				&set_ownership_permissions($st[4], $st[5], undef, $full);
				}
			# Skip "content-type" as we work in binmode anyway and
			# skip empty line
			<STDIN>;
			<STDIN>;

# Read all lines until next boundary or form data end
			while(1) {
				$line = <STDIN>;
				if (!defined($line)) {
			    		push @errors, "Unexpected end of input";
					last MAINLOOP;
			        }
			        # Inform progress tracker about our actions
			      	$got += length($line);
		      		&$cbfunc($got, $ENV{'CONTENT_LENGTH'}, $file, $in{'id'});

# Some brainf###ing to deal with last CRLF
              			if (index($line,"$boundary") != -1 ||
				    index($line,"$boundary--") != -1) {
			  		chop($prevline);
			  		chop($prevline);
                  			if (!print OUTFILE $prevline) {
                      				push @errors, "text{'error_writing_file'} $path/$file";
		      				last MAINLOOP;
                  				}
					last;
					}
				else {
                  			if (!print OUTFILE $prevline) {
						push @errors, "text{'error_writing_file'} $path/$file";
				      		last MAINLOOP;
						}
					$prevline = $line;
					}
				}

# File saved, let`s go further
          		close(OUTFILE);

# Store which file were uploaded
          		my $fpath = $cwd;
          		my $ffile = $file;
          		my @subdirs = split('/', $ffile);
          		if (@subdirs > 1) {
          			$ffile = pop(@subdirs);
          			$fpath .= ("/" . join('/', @subdirs));
          			}
          		push(@uploaded_files, {'path' => $fpath, 'file' => $ffile});
      			}
		}
	else {
		# Just skip everything until next boundary or form end
		while (index($line, "$boundary") == -1 ||
		       index($line, "$boundary--") == -1) {
			$line = <STDIN>;
			}        
		}
	}

# Extract and delete uploaded files
if ($in{'extract_uploaded'}) {
	my @eerrors = &extract_files(\@uploaded_files, 1);
	@errors = (@eerrors, @errors)
		if (@eerrors);
	}

# Everything finished, inform progress tracker
&$cbfunc(-1, $ENV{'CONTENT_LENGTH'}, undef, $in{'id'});
if (scalar(@errors) > 0) {
	print_errors(@errors);
	}
else {
	&redirect("index.cgi?path=".&urlize($path));
	}

cmd: