added the --safe-links option to disallow symlinks outside the

destination tree

rsync.c

@@ -441,6 +441,15 @@ static void recv_generator(char *fname,struct file_list *flist,int i,int f_out)
 #if SUPPORT_LINKS
 		char lnk[MAXPATHLEN];
 		int l;
+		extern int safe_symlinks;
+
+		if (safe_symlinks && unsafe_symlink(file->link, fname)) {
+			if (verbose) {
+				rprintf(FINFO,"ignoring unsafe symlink %s -> %s\n",
+					fname,file->link);
+			}
+			return;
+		}
 		if (statret == 0) {
 			l = readlink(fname,lnk,MAXPATHLEN-1);
 			if (l > 0) {
@@ -457,9 +466,10 @@ static void recv_generator(char *fname,struct file_list *flist,int i,int f_out)
 				fname,file->link,strerror(errno));
 		} else {
 			set_perms(fname,file,NULL,0);
-			if (verbose) 
+			if (verbose) {
 				rprintf(FINFO,"%s -> %s\n",
 					fname,file->link);
+			}
 		}
 #endif
 		return;

rsync.yo

@@ -193,6 +193,13 @@ Here is a short summary of the options avalable in rsync. Please refer
 to the detailed description below for a complete description.
 
 verb(
+Usage: rsync [OPTION]... SRC [USER@]HOST:DEST
+  or   rsync [OPTION]... [USER@]HOST:SRC DEST
+  or   rsync [OPTION]... SRC DEST
+  or   rsync [OPTION]... [USER@]HOST::SRC DEST
+  or   rsync [OPTION]... SRC [USER@]HOST::DEST
+
+Options
  -v, --verbose               increase verbosity
  -c, --checksum              always checksum
  -a, --archive               archive mode
@@ -202,6 +209,7 @@ verb(
  -u, --update                update only (don't overwrite newer files)
  -l, --links                 preserve soft links
  -L, --copy-links            treat soft links like regular files
+     --safe-links            ignore links outside the destination tree
  -H, --hard-links            preserve hard links
  -p, --perms                 preserve permissions
  -o, --owner                 preserve owner (root only)
@@ -307,6 +315,11 @@ option all symbolic links are skipped.
 dit(bf(-L, --copy-links)) This tells rsync to treat symbolic links just
 like  ordinary files.
 
+dit(bf(--safe-links)) This tells rsync to ignore any symbolic links
+which point outside the destination tree. All absolute symlinks are
+also ignored. Using this option in conjunction with --relative may
+give unexpecetd results. 
+
 dit(bf(-H, --hard-links)) This tells rsync to recreate hard  links  on
 the  remote system  to  be the same as the local system. Without this
 option hard links are treated like regular files.