summaryrefslogtreecommitdiff
path: root/libexec/httpd
diff options
context:
space:
mode:
authorleot <leot@NetBSD.org>2018-12-15 12:39:22 +0000
committerleot <leot@NetBSD.org>2018-12-15 12:39:22 +0000
commitaf46bcfe84c140356f3d20ddac12f598bc454533 (patch)
tree071cd47a481c4d2ba1d04fe4f7e3e692e43a5c92 /libexec/httpd
parent75bf63047f5f1a625d15fd528d28c121caa50673 (diff)
Avoid .htpasswd exposure to authenticated users when .htpasswd is
in the slashdir too. Problem reported by JP via tech-security@ and discussed with <mrg>, thanks!
Diffstat (limited to 'libexec/httpd')
-rw-r--r--libexec/httpd/bozohttpd.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/libexec/httpd/bozohttpd.c b/libexec/httpd/bozohttpd.c
index e0777ca27a7..0dfb3825aa8 100644
--- a/libexec/httpd/bozohttpd.c
+++ b/libexec/httpd/bozohttpd.c
@@ -1,4 +1,4 @@
-/* $NetBSD: bozohttpd.c,v 1.104 2018/12/15 09:28:27 leot Exp $ */
+/* $NetBSD: bozohttpd.c,v 1.105 2018/12/15 12:39:22 leot Exp $ */
/* $eterna: bozohttpd.c,v 1.178 2011/11/18 09:21:15 mrg Exp $ */
@@ -1467,7 +1467,7 @@ check_bzredirect(bozo_httpreq_t *request)
} else if (basename == NULL) {
strcpy(path, ".");
strcpy(dir, "");
- basename = dir;
+ basename = request->hr_file + 1;
} else {
*basename++ = '\0';
strcpy(path, dir);