Skip to content

Instantly share code, notes, and snippets.

@kosztik
Last active August 3, 2019 09:23
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save kosztik/4e59af1adef8646707da3bce8b6db23a to your computer and use it in GitHub Desktop.
Save kosztik/4e59af1adef8646707da3bce8b6db23a to your computer and use it in GitHub Desktop.
upload check for suhosin
#!/usr/bin/perl
#use strict;
#use warnings;
# ===============================================================================================================
# ===================================== DEBUG START
# ===============================================================================================================
#open(my $fh, '>>', '/tmp/report.txt');
## feltolteskor a felhasznalo tulajdona lesz a file, es mas nem is tudja
## megnyitni, a clamdscan sem!
### $result = `chmod 755 $ARGV[0]`;
## debuggolas miatt atmasoltam (/tempikecske) a fajlt es megneztem a jogosultsagokat, igy jottem ra a fentiekre!
# ===============================================================================================================
# ===================================== DEBUG END
# ===============================================================================================================
$tempname = `/bin/mktemp -p /tmp`;
@nev = split ('\/', $ARGV[0]);
$result = `/bin/cp $ARGV[0] $tempname`;
$result = `chmod 665 $tempname`;
$result = `/usr/bin/clamdscan --infected --no-summary $tempname`;
#print $fh $tempname." ".$result;
if ( length $result == 0 ) {
$istext=`file $tempname`;
$i=0;
## text file-t nem lehet feltölteni!
if ( index($istext, "text") != -1 ) {$i=1; }
## meg zippet sem
if ( index($istext, "Zip") != -1 ) {$i=1; }
## meg a gif-et sem
if ( index($istext, "GIF") != -1 ) {$i=1; }
if ( $i==1 ) {
print STDOUT "0\n";
`logger suhosin fileupload ALERT upload.pm - $result @nev REJECT UPLOAD-$istext`;
} else {
print STDOUT "1\n";
`logger suhosin fileupload OK upload.pm - $result @nev`;
}
}
if ( length $result >0 ) {
print STDOUT "0\n";
`logger suhosin fileupload ALERT upload.pm - $result @nev`;
}
$result = `rm $tempname`;
#close $fh;
__END__
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment