1. 23 Jan, 2000 1 commit
  2. 10 Jan, 2000 3 commits
  3. 07 Jan, 2000 1 commit
    • David Dykstra's avatar
      Upgrade lib/fnmatch.[ch] to the latest from glibc-2.1.2 because the · 9dce9b45
      David Dykstra authored
      FNM_PATHNAME flag (to stop at slashes in path names) was not working.
      
      Ironically, the bug in glibc's fnmatch was reported on the rsync mailing
      list in late October, and rsync's configure.in was changed to detect the
      bad glibc and use the internal fnmatch, but the internal fnmatch was based
      on the same buggy glibc!
      9dce9b45
  4. 06 Jan, 2000 2 commits
  5. 29 Dec, 1999 3 commits
  6. 09 Dec, 1999 1 commit
  7. 03 Dec, 1999 1 commit
  8. 02 Dec, 1999 1 commit
  9. 23 Nov, 1999 1 commit
  10. 15 Nov, 1999 1 commit
  11. 08 Nov, 1999 4 commits
  12. 04 Nov, 1999 1 commit
  13. 01 Nov, 1999 2 commits
  14. 31 Oct, 1999 6 commits
  15. 27 Oct, 1999 1 commit
  16. 25 Oct, 1999 1 commit
  17. 19 Oct, 1999 1 commit
  18. 06 Sep, 1999 1 commit
  19. 30 Aug, 1999 1 commit
  20. 09 Jul, 1999 2 commits
    • David Dykstra's avatar
      Add a couple clarifying points to the sanitize_path() comments. · 79452d46
      David Dykstra authored
      One is a note that a leading "/" in a symlink target will not behave
      exactly as if a chroot had occurred, but I decided it wasn't worth the
      making it the same.
      
      The other is note about an extra harmless trailing "." that is added under
      some rare circumstances.
      79452d46
    • David Dykstra's avatar
      Fix significant security holes with "use chroot = no" in an rsync daemon: · cb13abfe
      David Dykstra authored
          1. The file paths being sent and received were not "sanitized" to
      	ensure that there weren't any ".." components that would escape the
      	top level directory.  This can't happen with the standard rsync
      	client, but it could be exploited on both read and write if someone
      	modified an rsync client.  This fix sanitizes all incoming and
      	outgoing paths when "use chroot = no".
      
          2. If a module is also "read only = no", clients could have created
      	symbolic links with ".." components that would allow writing
      	outside of the module.  This could happen with the standard rsync
      	client.  This fix sanitizes all incoming symbolic link targets
      	when "use chroot = no".
      
      Previously, only top-level paths (anything passed in command line arguments)
      were sanitized.  Sorry, I didn't think about the individual file paths
      before now.
      cb13abfe
  21. 27 Jun, 1999 1 commit
  22. 26 Jun, 1999 1 commit
  23. 13 Apr, 1999 1 commit
  24. 06 Apr, 1999 2 commits