avoid to allow reading files which are not under the webserver directory
[psensor.git] / src / server / server.c
index f4557d8..95998c8 100644 (file)
@@ -23,6 +23,7 @@
 #include <libintl.h>
 #define _(str) gettext(str)
 
+#include <limits.h>
 #include <stdarg.h>
 #include <stdio.h>
 #include <stdlib.h>
 
 #ifdef HAVE_GTOP
 #include "sysinfo.h"
-#include "cpu.h"
+#include <pgtop2.h>
 #endif
 
-#include "log.h"
+#include <hdd.h>
+#include <lmsensor.h>
+#include <plog.h>
 #include "psensor_json.h"
+#include <pmutex.h>
 #include "url.h"
 #include "server.h"
 #include "slog.h"
@@ -61,24 +65,24 @@ static const int DEFAULT_PORT = 3131;
 "Page not found - Go to <a href='/'>Main page</a></p></body>"))
 
 static struct option long_options[] = {
-       {"version", no_argument, 0, 'v'},
-       {"help", no_argument, 0, 'h'},
-       {"port", required_argument, 0, 'p'},
-       {"wdir", required_argument, 0, 'w'},
-       {"debug", required_argument, 0, 'd'},
-       {"log-file", required_argument, 0, 'l'},
-       {"sensor-log-file", required_argument, 0, 0},
-       {"sensor-log-interval", required_argument, 0, 0},
-       {0, 0, 0, 0}
+       {"version", no_argument, NULL, 'v'},
+       {"help", no_argument, NULL, 'h'},
+       {"port", required_argument, NULL, 'p'},
+       {"wdir", required_argument, NULL, 'w'},
+       {"debug", required_argument, NULL, 'd'},
+       {"log-file", required_argument, NULL, 'l'},
+       {"sensor-log-file", required_argument, NULL, 0},
+       {"sensor-log-interval", required_argument, NULL, 0},
+       {NULL, 0, NULL, 0}
 };
 
 static struct server_data server_data;
 
-static pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;
+static pthread_mutex_t mutex;
 
 static int server_stop_requested;
 
-static void print_version()
+static void print_version(void)
 {
        printf("psensor-server %s\n", VERSION);
        printf(_("Copyright (C) %s jeanfi@gmail.com\n"
@@ -89,7 +93,7 @@ static void print_version()
               "2010-2012");
 }
 
-static void print_help()
+static void print_help(void)
 {
        printf(_("Usage: %s [OPTION]...\n"), program_name);
 
@@ -242,27 +246,39 @@ static struct MHD_Response *create_response_file(const char *nurl,
 static struct MHD_Response *
 create_response(const char *nurl, const char *method, unsigned int *rp_code)
 {
+       char *page, *fpath, *rpath;
        struct MHD_Response *resp = NULL;
+       int n;
 
        if (!strncmp(nurl, URL_BASE_API_1_1, strlen(URL_BASE_API_1_1))) {
                resp = create_response_api(nurl, method, rp_code);
        } else {
-               char *fpath = get_path(nurl, server_data.www_dir);
-
-               resp = create_response_file(nurl, method, rp_code, fpath);
+               fpath = get_path(nurl, server_data.www_dir);
+
+               rpath = realpath(fpath, NULL);
+               if (rpath) {
+                       n = strlen(server_data.www_dir);
+                       if (!strncmp(server_data.www_dir, rpath, n))
+                               resp = create_response_file(nurl,
+                                                           method,
+                                                           rp_code,
+                                                           fpath);
+                       free(rpath);
+               }
 
                free(fpath);
        }
 
-       if (resp) {
+       if (resp)
                return resp;
-       } else {
-               char *page = strdup(PAGE_NOT_FOUND);
-               *rp_code = MHD_HTTP_NOT_FOUND;
 
-               return MHD_create_response_from_data
-                       (strlen(page), page, MHD_YES, MHD_NO);
-       }
+       page = strdup(PAGE_NOT_FOUND);
+       *rp_code = MHD_HTTP_NOT_FOUND;
+
+       return MHD_create_response_from_data(strlen(page),
+                                            page,
+                                            MHD_YES,
+                                            MHD_NO);
 }
 
 static int cbk_http_request(void *cls,
@@ -271,7 +287,8 @@ static int cbk_http_request(void *cls,
                            const char *method,
                            const char *version,
                            const char *upload_data,
-                           size_t *upload_data_size, void **ptr)
+                           size_t *upload_data_size,
+                           void **ptr)
 {
        static int dummy;
        struct MHD_Response *response;
@@ -298,9 +315,9 @@ static int cbk_http_request(void *cls,
 
        nurl = url_normalize(url);
 
-       pthread_mutex_lock(&mutex);
+       pmutex_lock(&mutex);
        response = create_response(nurl, method, &resp_code);
-       pthread_mutex_unlock(&mutex);
+       pmutex_unlock(&mutex);
 
        ret = MHD_queue_response(connection, resp_code, response);
        MHD_destroy_response(response);
@@ -343,7 +360,7 @@ int main(int argc, char *argv[])
                switch (optc) {
                case 'w':
                        if (optarg)
-                               server_data.www_dir = strdup(optarg);
+                               server_data.www_dir = realpath(optarg, NULL);
                        break;
                case 'p':
                        if (optarg)
@@ -382,17 +399,25 @@ int main(int argc, char *argv[])
                exit(EXIT_FAILURE);
        }
 
-       if (!server_data.www_dir)
-               server_data.www_dir = strdup(DEFAULT_WWW_DIR);
+       if (!server_data.www_dir) {
+               server_data.www_dir = realpath(DEFAULT_WWW_DIR, NULL);
+               if (!server_data.www_dir) {
+                       fprintf(stderr,
+                               _("Webserver directory does not exist.\n"));
+                       exit(EXIT_FAILURE);
+               }
+       }
 
        if (!log_file)
                log_file = strdup(DEFAULT_LOG_FILE);
 
+       pmutex_init(&mutex);
+
        log_open(log_file);
 
-       psensor_init();
+       hddtemp_psensor_list_append(&server_data.sensors, 600);
 
-       server_data.sensors = get_all_sensors(0, 600);
+       lmsensor_psensor_list_append(&server_data.sensors, 600);
 
 #ifdef HAVE_GTOP
        server_data.cpu_usage = create_cpu_usage_sensor(600);
@@ -426,17 +451,24 @@ int main(int argc, char *argv[])
        }
 
        while (!server_stop_requested) {
-               pthread_mutex_lock(&mutex);
+               pmutex_lock(&mutex);
 
 #ifdef HAVE_GTOP
                sysinfo_update(&server_data.psysinfo);
                cpu_usage_sensor_update(server_data.cpu_usage);
 #endif
-               psensor_list_update_measures(server_data.sensors);
+
+#ifdef HAVE_ATASMART
+               atasmart_psensor_list_update(server_data.sensors);
+#endif
+
+               hddtemp_psensor_list_update(server_data.sensors);
+
+               lmsensor_psensor_list_update(server_data.sensors);
 
                psensor_log_measures(server_data.sensors);
 
-               pthread_mutex_unlock(&mutex);
+               pmutex_unlock(&mutex);
                sleep(5);
        }
 
@@ -450,11 +482,10 @@ int main(int argc, char *argv[])
        psensor_free(server_data.cpu_usage);
 #endif
        free(server_data.www_dir);
-       sensors_cleanup();
+       lmsensor_cleanup();
 
 #ifdef HAVE_GTOP
        sysinfo_cleanup();
-       cpu_cleanup();
 #endif
 
        if (log_file != DEFAULT_LOG_FILE)