home
readme
diff
tree
note
docs
0commit 754ba7b2a5e28d740f9a3785cb031d854924c327
1Author: lakefox <mason@lakefox.net>
2Date: Sat Jan 31 12:50:11 2026 -0700
3
4 Security fixes
5
6diff --git a/cgi-bin/mailto.awk b/cgi-bin/mailto.awk
7index 28d0040..34483b8 100755
8--- a/cgi-bin/mailto.awk
9+++ b/cgi-bin/mailto.awk
10@@ -61,21 +61,26 @@ BEGIN {
11 }
12
13 if (email != "") {
14- if (action == "subscribe") {
15- print email >> "/var/mailto/" list ".txt"
16- } else if (action == "unsubscribe") {
17- file = "/var/mailto/" list ".txt"
18- tmp = file ".tmp"
19-
20- while ((getline line < file) > 0) {
21- if (line != email) # keep everything except the email
22- print line > tmp
23+ file = "/var/mailto/" list ".txt"
24+
25+ if (system("test -f \"" file "\"") == 0) {
26+ if (action == "subscribe") {
27+ if (system("grep -Fqx \"" email "\" \"" file "\"") != 0) {
28+ print email >> file
29+ close(file)
30+ }
31+ } else if (action == "unsubscribe") {
32+ tmp = file ".tmp"
33+ while ((getline line < file) > 0) {
34+ if (line != email) {
35+ print line > tmp
36+ }
37+ }
38+ close(file)
39+ close(tmp)
40+ system("mv \"" tmp "\" \"" file "\"")
41 }
42- close(file)
43- close(tmp)
44- system("mv \"" tmp "\" \"" file "\"") # atomic replace
45 }
46-
47 redirect(referer)
48 } else if (view != "") {
49 openMail(list, view)
50@@ -114,7 +119,7 @@ function showLists(name) {
51
52 if (length(parts) == 1 || name == "") {
53 # Print out all of the mailing lists
54- cmd = "ls /var/mailto/" parts[1]
55+ cmd = "ls '/var/mailto/" parts[1] "'"
56
57 if (name != "") {
58 name = name "/"
59@@ -145,7 +150,7 @@ function showLists(name) {
60
61 print "<a href='mailto:"
62
63- cmd = "cat /var/mailto/" parts[1] "/" parts[2] ".txt"
64+ cmd = "cat '/var/mailto/" parts[1] "/" parts[2] ".txt'"
65 while (cmd | getline address) {
66 print address ","
67 }
68@@ -153,7 +158,7 @@ function showLists(name) {
69
70 print "?subject=" name ": Your Title'>New</a>"
71
72- cmd = "ls -t -1 /var/mailto/.cache/" name
73+ cmd = "ls -t -1 '/var/mailto/.cache/" name "'"
74
75 print "<ul>"
76 while (cmd | getline line) {
77@@ -183,7 +188,7 @@ function openMail(folder, uid) {
78 print "</head>"
79 print "<body>"
80
81- cmd = "cat /var/mailto/.cache/" folder "/*." uid
82+ cmd = "cat '/var/mailto/.cache/" folder "/*.'" uid
83
84 while (cmd | getline line) {
85 print line
86@@ -207,7 +212,7 @@ function getThreads(username, password, inbox) {
87 }
88 close(cmd)
89
90- cmd = "ls /var/mailto/.cache/*/* | grep '<>'"
91+ cmd = "ls '/var/mailto/.cache/*/*' | grep '<>'"
92 files = ""
93
94 while (cmd | getline line) {