aboutsummaryrefslogtreecommitdiffstats
path: root/main/awstats/CVE-2020-35176.patch
blob: 3e707c35dc49fbf7d4a4ae12604d7ae59350e336 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
From 0d4d4c05f8e73be8f71dd361dc55cbd52858b823 Mon Sep 17 00:00:00 2001
From: Beuc <beuc@beuc.net>
Date: Thu, 17 Dec 2020 18:14:43 +0100
Subject: [PATCH] Only look for configuration in dedicated awstats directories

Fixes #195/CVE-2020-35176
---
 wwwroot/cgi-bin/awstats.pl | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/wwwroot/cgi-bin/awstats.pl b/wwwroot/cgi-bin/awstats.pl
index e709b7f5..8341c0a5 100755
--- a/wwwroot/cgi-bin/awstats.pl
+++ b/wwwroot/cgi-bin/awstats.pl
@@ -1711,13 +1711,13 @@ sub Read_Config {
 	# Check config file in common possible directories :
 	# Windows :                   				"$DIR" (same dir than awstats.pl)
 	# Standard, Mandrake and Debian package :	"/etc/awstats"
-	# Other possible directories :				"/usr/local/etc/awstats", "/etc"
+	# Other possible directories :				"/usr/local/etc/awstats",
 	# FHS standard, Suse package : 				"/etc/opt/awstats"
 	my $configdir         = shift;
 	my @PossibleConfigDir = (
 			"$DIR",
 			"/etc/awstats",
-			"/usr/local/etc/awstats", "/etc",
+			"/usr/local/etc/awstats",
 			"/etc/opt/awstats"
 		);