On Fri, Jul 20, 2012 at 11:55 PM, Marcus Comstedt (ACROSS) (Hail Ilpalazzo!) @ Pike (-) developers forum 10353@lyskom.lysator.liu.se wrote:
should be relative to the chroot point. The correct value is the of full before the initial / was removed. But you could also use "/"+full.
Apparently full does not neccessarily include the / anyway. :)
Well, if wd doesn't start with a /, then there will be no initial / to strip. Looking at the code, it seems like create() actually does strip initial /'s from wd, which was presumably the initial attempt to support chroot. But that didn't really work, since combine_path(wd, file) will still start with a slash if file does... Hence the stripping in other (but not all necessary) places, which rendered the stripping in create() unneccessary although nobody seems to have removed it. Quite a mess... :-/
In fact, stripping the intial / of wd seems like a very bad idea. Consider if the intended wd is "/foo".
combine_path("/foo", "../../bar") => "/bar", but combine_path("foo", "../../bar") => "../bar".
So if you strip the / from wd, you will be able to ascend above the chroot by using .., but that will not happen if you keep the / in wd and strip it from full instead.
pike-devel@lists.lysator.liu.se