Mercurial > hg > nginx

comparison src/core/ngx_open_file_cache.c @ 4487:a786c85e8268

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Disable symlinks: don't allow creating or truncating a file via a symlink in the last path component if "if_not_owner" parameter is used. To prevent race condition we have to open a file before checking its owner and there's no way to change access flags for already opened file descriptor, so we disable symlinks for the last path component at all if flags allow creating or truncating the file.
author Valentin Bartenev <vbart@nginx.com>
date Tue, 21 Feb 2012 15:04:41 +0000
parents a996bb40a0bb
children d33ce8cd0d70
comparison
equal deleted inserted replaced
4486:a996bb40a0bb 4487:a786c85e8268
676 fd = NGX_INVALID_FILE; 676 fd = NGX_INVALID_FILE;
677 677
678 goto failed; 678 goto failed;
679 } 679 }
680 680
681 if (of->disable_symlinks == NGX_DISABLE_SYMLINKS_NOTOWNER) { 681 if (of->disable_symlinks == NGX_DISABLE_SYMLINKS_NOTOWNER
682 && !(create & (NGX_FILE_CREATE_OR_OPEN|NGX_FILE_TRUNCATE)))
683 {
682 fd = ngx_openat_file_owner(at_fd, p, mode, create, access, log); 684 fd = ngx_openat_file_owner(at_fd, p, mode, create, access, log);
683 685
684 } else { 686 } else {
685 fd = ngx_openat_file(at_fd, p, mode|NGX_FILE_NOFOLLOW, create, access); 687 fd = ngx_openat_file(at_fd, p, mode|NGX_FILE_NOFOLLOW, create, access);
686 } 688 }