debian/patches/u_xhdr_permissions

   1 XHDR and XPAT were not checking the permissions the user has to read
   2 articles when using a message-ID. Now fixed, as well as calls to ARTclose().
   3
   4 http://inn.eyrie.org/viewcvs/branches/2.4/nnrpd/article.c?r1=8004&r2=8003&pathrev=8004&view=patch
   5
   6 --- 2.4/nnrpd/article.c 2008/09/05 19:13:28     8003
   7 +++ 2.4/nnrpd/article.c 2008/09/06 08:49:55     8004
   8 @@ -688,6 +688,7 @@
   9      if (ac > 1)
  10         ARTnumber = tart;
  11      if ((msgid = GetHeader("Message-ID")) == NULL) {
  12 +        ARTclose();
  13          Reply("%s\r\n", ARTnoartingroup);
  14         return;
  15      }
  16 @@ -745,9 +746,9 @@
  17          if (!ARTopen(ARTnumber))
  18              continue;
  19          msgid = GetHeader("Message-ID");
  20 +        ARTclose();
  21      } while (msgid == NULL);
  22
  23 -    ARTclose();
  24      Reply("%d %d %s Article retrieved; request text separately.\r\n",
  25            NNTP_NOTHING_FOLLOWS_VAL, ARTnumber, msgid);
  26  }
  27 @@ -1008,6 +1009,12 @@
  28                 Printf("%d No such article.\r\n", NNTP_DONTHAVEIT_VAL);
  29                 break;
  30             }
  31 +            if (!PERMartok()) {
  32 +                ARTclose();
  33 +                Printf("%s\r\n", NOACCESS);
  34 +                break;
  35 +            }
  36 +
  37             Printf("%d %s matches follow (ID)\r\n", NNTP_HEAD_FOLLOWS_VAL,
  38                    header);
  39             if ((text = GetHeader(header)) != NULL
  40 @@ -1047,8 +1054,8 @@
  41                     SendIOb(buff, strlen(buff));
  42                     SendIOb(p, strlen(p));
  43                     SendIOb("\r\n", 2);
  44 -                   ARTclose();
  45                 }
  46 +                ARTclose();
  47             }
  48             SendIOb(".\r\n", 3);
  49             PushIOb();