From 7536c8e4a052bc889e434da3f6df8ae47faedd3d Mon Sep 17 00:00:00 2001
From: Till Brehm <tbrehm@ispconfig.org>
Date: Mon, 25 Aug 2014 11:10:10 -0400
Subject: [PATCH] Updated security README.txt
---
server/lib/classes/system.inc.php | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/server/lib/classes/system.inc.php b/server/lib/classes/system.inc.php
index 3001c64..af42e5e 100644
--- a/server/lib/classes/system.inc.php
+++ b/server/lib/classes/system.inc.php
@@ -1824,7 +1824,7 @@
$name_blacklist = array('root','ispconfig','vmail','getmail');
if(in_array($username,$name_blacklist)) return false;
- if(preg_match('/^[\w\.\-]{0,32}$/', $username) == false) return false;
+ if(preg_match('/^[a-zA-Z0-9\.\-_]{1,32}$/', $username) == false) return false;
if($check_id && intval($this->getuid($username)) < $this->min_uid) return false;
@@ -1833,15 +1833,15 @@
return true;
}
- public function is_allowed_group($groupname, $restrict_names = false) {
+ public function is_allowed_group($groupname, $check_id = true, $restrict_names = false) {
global $app;
$name_blacklist = array('root','ispconfig','vmail','getmail');
if(in_array($groupname,$name_blacklist)) return false;
- if(preg_match('/^[\w\.\-]{0,32}$/', $groupname) == false) return false;
+ if(preg_match('/^[a-zA-Z0-9\.\-_]{1,32}$/', $groupname) == false) return false;
- if(intval($this->getgid($groupname)) < $this->min_gid) return false;
+ if($check_id && intval($this->getgid($groupname)) < $this->min_gid) return false;
if($restrict_names == true && preg_match('/^client\d+$/', $groupname) == false) return false;
--
Gitblit v1.9.1