| 196 | }; |
| 197 | |
| 198 | static int translate_userdir(request_rec *r) |
| 199 | { |
| 200 | ap_conf_vector_t *server_conf; |
| 201 | const userdir_config *s_cfg; |
| 202 | const char *userdirs; |
| 203 | const char *user, *dname; |
| 204 | char *redirect; |
| 205 | apr_finfo_t statbuf; |
| 206 | |
| 207 | /* |
| 208 | * If the URI doesn't match our basic pattern, we've nothing to do with |
| 209 | * it. |
| 210 | */ |
| 211 | if (r->uri[0] != '/' || r->uri[1] != '~') { |
| 212 | return DECLINED; |
| 213 | } |
| 214 | server_conf = r->server->module_config; |
| 215 | s_cfg = ap_get_module_config(server_conf, &userdir_module); |
| 216 | userdirs = s_cfg->userdir; |
| 217 | if (userdirs == NULL) { |
| 218 | return DECLINED; |
| 219 | } |
| 220 | |
| 221 | dname = r->uri + 2; |
| 222 | user = ap_getword(r->pool, &dname, '/'); |
| 223 | |
| 224 | /* |
| 225 | * The 'dname' funny business involves backing it up to capture the '/' |
| 226 | * delimiting the "/~user" part from the rest of the URL, in case there |
| 227 | * was one (the case where there wasn't being just "GET /~user HTTP/1.0", |
| 228 | * for which we don't want to tack on a '/' onto the filename). |
| 229 | */ |
| 230 | |
| 231 | if (dname[-1] == '/') { |
| 232 | --dname; |
| 233 | } |
| 234 | |
| 235 | /* |
| 236 | * If there's no username, it's not for us. Ignore . and .. as well. |
| 237 | */ |
| 238 | if (user[0] == '\0' || |
| 239 | (user[1] == '.' && (user[2] == '\0' || |
| 240 | (user[2] == '.' && user[3] == '\0')))) { |
| 241 | return DECLINED; |
| 242 | } |
| 243 | /* |
| 244 | * Nor if there's an username but it's in the disabled list. |
| 245 | */ |
| 246 | if (apr_table_get(s_cfg->disabled_users, user) != NULL) { |
| 247 | return DECLINED; |
| 248 | } |
| 249 | /* |
| 250 | * If there's a global interdiction on UserDirs, check to see if this |
| 251 | * name is one of the Blessed. |
| 252 | */ |
| 253 | if (s_cfg->globally_disabled == O_DISABLE |
| 254 | && apr_table_get(s_cfg->enabled_users, user) == NULL) { |
| 255 | return DECLINED; |
nothing calls this directly
no test coverage detected