fix for vpath directory traversals

ChrootHelper.c

@@ -163,7 +163,6 @@ const char *ptr;
 	{
 		Value=UnQuoteStr(Value,Tempstr);
 
-
 		if (strcmp(Name,"User")==0) Response->UserName=CopyStr(Response->UserName,Value);
 		else if (strcmp(Name,"Password")==0) Response->Password=CopyStr(Response->Password,Value);
 		else if (strcmp(Name,"RealUser")==0) Response->RealUser=CopyStr(Response->RealUser,Value);

VPath.c

@@ -168,6 +168,8 @@ int result=FALSE, Flags=0;
 //Document name here is whatever part of the Path is *beyond* the VPath component
 DocName=VPathSubstituteArgs(DocName, Session->Path + StrLen(VPath->URL), Session);
 
+//search through all paths that the vpath applies to to see if the document exists in any of them
+//this allows us to have a vpath map to more than one directory
 ptr=GetToken(VPath->Path,":",&Tempstr,0);
 while (ptr)
 {
@@ -180,9 +182,11 @@ while (ptr)
 	ptr=GetToken(ptr,":",&Tempstr,0);
 }
 
+
 Tempstr=CopyStr(Tempstr,"");
 if (StrValid(LocalPath)) Tempstr=FindFileInPath(Tempstr,DocName,LocalPath);
 
+//if we found a file matching the request, handle it
 if (StrValid(Tempstr)) 
 {
 	Flags = HEADERS_SENDFILE|HEADERS_USECACHE|HEADERS_KEEPALIVE;

common.c

@@ -6,7 +6,7 @@
 #include "Authenticate.h"
 
 TSettings Settings;
-char *Version="3.1";
+char *Version="3.2";
 
 void SetTimezoneEnv()
 {