32
31
from ivle import util
34
33
# Make a Subversion client object (for published)
35
34
svnclient = pysvn.Client()
37
def url_to_local(urlpath):
36
def url_to_local(config, urlpath):
38
37
"""Given a URL path (part of a URL query string, see below), returns a
40
39
* the username of the student whose directory is being browsed
52
51
Returns (None, None) if the path is empty.
54
See also: ivle.conf.jail_base
53
>>> stubconfig = {'paths': {'jails': {'mounts': '/jails'}}}
55
>>> url_to_local(stubconfig, 'joe/foo/bar/baz')
56
('joe', '/jails/joe/home/joe/foo/bar/baz')
57
>>> url_to_local(stubconfig, 'joe')
58
('joe', '/jails/joe/home/joe')
59
>>> url_to_local(stubconfig, 'joe/')
60
('joe', '/jails/joe/home/joe')
62
We have some protection from various potential attacks. An empty,
63
absolute, or ..-prefixed path yields a special result.
65
>>> url_to_local(stubconfig, '')
67
>>> url_to_local(stubconfig, '/foo')
69
>>> url_to_local(stubconfig, '../bar')
56
73
# First normalise the path
57
74
urlpath = os.path.normpath(urlpath)
58
75
# Now if it begins with ".." or separator, then it's illegal
68
85
# accordance with our directory scheme.
69
86
# (The first time is the name of the jail, the second is the user's home
70
87
# directory within the jail).
71
path = os.path.join(ivle.conf.jail_base, user, 'home', urlpath)
88
path = os.path.join(config['paths']['jails']['mounts'],
89
user, 'home', urlpath)
73
91
return (user, path)
75
def url_to_jailpaths(urlpath):
93
def url_to_jailpaths(config, urlpath):
76
94
"""Given a URL path (part of a URL query string), returns a tuple of
77
95
* the username of the student whose directory is being browsed
78
96
* the absolute path where the jail will be located.
81
99
urlpath: See urlpath in url_to_local.
83
>>> url_to_jailpaths("joe/mydir/myfile")
84
('joe', '/var/lib/ivle/jailmounts/joe', '/home/joe/mydir/myfile')
101
>>> stubconfig = {'paths': {'jails': {'mounts': '/jails'}}}
86
>>> url_to_jailpaths("")
103
>>> url_to_jailpaths(stubconfig, "joe/mydir//myfile/.././myfile")
104
('joe', '/jails/joe', '/home/joe/mydir/myfile')
105
>>> url_to_jailpaths(stubconfig, "")
107
>>> url_to_jailpaths(stubconfig, "../foo")
109
>>> url_to_jailpaths(stubconfig, "/foo")
87
110
(None, None, None)
89
112
# First normalise the path
90
113
urlpath = os.path.normpath(urlpath)
91
# Now if it begins with ".." then it's illegal
92
if urlpath.startswith(".."):
114
# Now if it begins with "..", or is absolute, then it's illegal
115
if urlpath.startswith("..") or os.path.isabs(urlpath):
93
116
return (None, None, None)
94
117
# Note: User can be a group name. There is absolutely no difference in our
95
118
# current directory scheme.
96
119
(user, subpath) = util.split_path(urlpath)
97
120
if user is None: return (None, None, None)
99
jail = os.path.join(ivle.conf.jail_base, user)
100
path = os.path.join('/home', urlpath)
122
jail = os.path.join(config['paths']['jails']['mounts'], user)
123
path = to_home_path(urlpath)
102
125
return (user, jail, path)
127
def to_home_path(urlpath):
128
"""Given a URL path (eg. joe/foo/bar/baz), returns a path within the home.
130
>>> to_home_path('joe/foo/bar/baz')
131
'/home/joe/foo/bar/baz'
132
>>> to_home_path('joe/foo//bar/baz/../../')
134
>>> to_home_path('joe/foo//bar/baz/../../../../../') is None
138
urlpath = os.path.normpath(urlpath)
139
# If it begins with '..', it's illegal.
140
if urlpath.startswith(".."):
143
return os.path.join('/home', urlpath)
104
145
def svnpublished(path):
105
146
"""Given a path on the LOCAL file system, determines whether the path has
106
147
its "ivle:published" property active (in subversion). Returns True
162
203
Same interface as "authorize" - None on success, HTTP_FORBIDDEN exception
163
204
raised on failure.
165
_, path = url_to_local(req.path)
206
_, path = url_to_local(req.config, req.path)
167
208
# Walk up the tree, and find the deepest directory.
168
209
while not os.path.isdir(path):
added
removed
ivle/studpath.py
