#! /bin/sh /usr/share/dpatch/dpatch-run
## 11_missed_security_fixes.dpatch by  <camrdale@gmail.com>
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: Add more security fixes missed in previous patches.

@DPATCH@
diff -urNad torrentflux~/html/admin.php torrentflux/html/admin.php
--- torrentflux~/html/admin.php	2006-11-27 20:29:55.000000000 -0800
+++ torrentflux/html/admin.php	2006-11-27 20:29:56.000000000 -0800
@@ -322,7 +322,7 @@
             $user_icon = "images/user.gif";
         }
 
-        $ip_info = htmlentities($ip_resolved)."<br>".htmlentities($user_agent);
+        $ip_info = htmlentities($ip_resolved, ENT_QUOTES)."<br>".htmlentities($user_agent, ENT_QUOTES);
 
         $output .= "<tr>";
         if (IsUser($user_id))
diff -urNad torrentflux~/html/dir.php torrentflux/html/dir.php
--- torrentflux~/html/dir.php	2006-11-27 20:29:55.000000000 -0800
+++ torrentflux/html/dir.php	2006-11-27 20:29:56.000000000 -0800
@@ -255,7 +255,15 @@
 echo "<br>";
 
 if(!isset($dir)) $dir = "";
+
+if (!file_exists($cfg["path"].$dir))
+{
+    echo "<strong>".$dir."</strong> could not be found or is not valid.";
+}
+else
+{
 ListDirectory($cfg["path"].$dir);
+}
 
 DisplayFoot();
 
diff -urNad torrentflux~/html/functions.php torrentflux/html/functions.php
--- torrentflux~/html/functions.php	2006-11-27 20:29:55.000000000 -0800
+++ torrentflux/html/functions.php	2006-11-27 20:36:40.000000000 -0800
@@ -2133,7 +2133,7 @@
     $size = @filesize($file);
     if ( $size == 0)
     {
-        $size = exec("ls -l \"".$file."\" | awk '{print $5}'");
+        $size = exec("ls -l \"". escapeshellarg( $file ) ."\" | awk '{print $5}'");
     }
     return $size;
 }
diff -urNad torrentflux~/html/maketorrent.php torrentflux/html/maketorrent.php
--- torrentflux~/html/maketorrent.php	2006-11-27 20:29:55.000000000 -0800
+++ torrentflux/html/maketorrent.php	2006-11-27 20:31:31.000000000 -0800
@@ -108,7 +108,7 @@
         // Set the piece size
         if( !empty( $peice ) )
         {
-            $app .= "--piece_size_pow2 " . $peice . " ";
+            $app .= "--piece_size_pow2 " . escapeshellarg( $peice ) . " ";
         }
 
         if( !empty( $ancelist ) )
diff -urNad torrentflux~/html/metaInfo.php torrentflux/html/metaInfo.php
--- torrentflux~/html/metaInfo.php	2006-11-27 20:29:55.000000000 -0800
+++ torrentflux/html/metaInfo.php	2006-11-27 20:29:56.000000000 -0800
@@ -106,7 +106,7 @@
 {
     global $cfg;
 
-    if (empty($torrent))
+    if (empty($torrent) || !file_exists($cfg["torrent_file_path"].$torrent))
     {
         echo _NORECORDSFOUND;
     }
@@ -122,6 +122,13 @@
         $ftorrent=$cfg["torrent_file_path"].$torrent;
 
         $fp = fopen($ftorrent, "rd");
+        if (!$fp)
+        {
+            // Not able to open file
+            echo _NORECORDSFOUND;
+        }
+        else
+        {
         $alltorrent = fread($fp, filesize($ftorrent));
         fclose($fp);
 
@@ -241,6 +248,7 @@
             echo htmlentities($btmeta['info']['name'].$torrent_size." (".formatBytesToKBMGGB($torrent_size).")", ENT_QUOTES);
         }
     }
+    }
     else
     {
         $result = shell_exec("cd " . $cfg["torrent_file_path"]."; " . $cfg["pythonCmd"] . " -OO " . $cfg["btshowmetainfo"]." \"".$torrent."\"");
diff -urNad torrentflux~/html/setpriority.php torrentflux/html/setpriority.php
--- torrentflux~/html/setpriority.php	2006-11-02 23:45:16.000000000 -0800
+++ torrentflux/html/setpriority.php	2006-11-27 20:29:56.000000000 -0800
@@ -22,6 +22,8 @@
     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 
+include_once("settingsfunctions.php");
+
 function getFile($var)
 {
     if ($var < 65535)
@@ -51,8 +53,8 @@
         $fileName = $cfg["torrent_file_path"].$alias.".prio";
 
         $result = array();
-
-        $files = array_filter($_REQUEST['files'],"getFile");
+        $files = array();
+        $files = array_filter(getRequestVar('files'),"getFile");
 
         // if there are files to get then process and create a prio file.
         if (count($files) > 0)
diff -urNad torrentflux~/html/startpop.php torrentflux/html/startpop.php
--- torrentflux~/html/startpop.php	2006-11-02 23:45:16.000000000 -0800
+++ torrentflux/html/startpop.php	2006-11-27 20:29:56.000000000 -0800
@@ -29,6 +29,12 @@
 $torrent = getRequestVar('torrent');
 $displayName = $torrent;
 
+if (!file_exists($cfg["torrent_file_path"].$torrent))
+{
+    echo $torrent." could not be found or does not exist.";
+    die();
+}
+
 if(strlen($displayName) >= 55)
 {
     $displayName = substr($displayName, 0, 52)."...";