Make sure 'make dist' keeps working.

[flightgear.git] / src / Main / fg_commands.cxx

diff --git a/src/Main/fg_commands.cxx b/src/Main/fg_commands.cxx
index caec3c0d1fc67d81d164631a6dfbe1617bd023d0..9b0fd0f40a5535795d250ae0a35d78a3d492ce15 100644 (file)
--- a/src/Main/fg_commands.cxx
+++ b/src/Main/fg_commands.cxx
@@ -8,8 +8,8 @@
 
 #include <simgear/compiler.h>
 
-#include STL_STRING
-#include STL_FSTREAM
+#include <string>
+#include <fstream>
 
 #include <simgear/sg_inlines.h>
 #include <simgear/debug/logstream.hxx>
@@ -18,6 +18,7 @@
 #include <simgear/structure/exception.hxx>
 #include <simgear/structure/commands.hxx>
 #include <simgear/props/props.hxx>
+#include <simgear/structure/event_mgr.hxx>
 
 #include <Cockpit/panel.hxx>
 #include <Cockpit/panel_io.hxx>
@@ -45,9 +46,9 @@
 #include "viewmgr.hxx"
 #include "main.hxx"
 
-SG_USING_STD(string);
-SG_USING_STD(ifstream);
-SG_USING_STD(ofstream);
+using std::string;
+using std::ifstream;
+using std::ofstream;
 
 
 \f
@@ -320,16 +321,25 @@ do_resume (const SGPropertyNode * arg)
 static bool
 do_load (const SGPropertyNode * arg)
 {
-  const string &file = arg->getStringValue("file", "fgfs.sav");
-  ifstream input(file.c_str());
-  if (input.good() && fgLoadFlight(input)) {
-    input.close();
-    SG_LOG(SG_INPUT, SG_INFO, "Restored flight from " << file);
-    return true;
-  } else {
-    SG_LOG(SG_INPUT, SG_WARN, "Cannot load flight from " << file);
-    return false;
-  }
+    string file = arg->getStringValue("file", "fgfs.sav");
+    if (file.size() < 4 || file.substr(file.size() - 4) != ".sav")
+        file += ".sav";
+
+    if (!fgValidatePath(file.c_str(), false)) {
+        SG_LOG(SG_IO, SG_ALERT, "load: reading '" << file << "' denied "
+                "(unauthorized access)");
+        return false;
+    }
+
+    ifstream input(file.c_str());
+    if (input.good() && fgLoadFlight(input)) {
+        input.close();
+        SG_LOG(SG_INPUT, SG_INFO, "Restored flight from " << file);
+        return true;
+    } else {
+        SG_LOG(SG_INPUT, SG_WARN, "Cannot load flight from " << file);
+        return false;
+    }
 }
 
 
@@ -342,18 +352,27 @@ do_load (const SGPropertyNode * arg)
 static bool
 do_save (const SGPropertyNode * arg)
 {
-  const string &file = arg->getStringValue("file", "fgfs.sav");
-  bool write_all = arg->getBoolValue("write-all", false);
-  SG_LOG(SG_INPUT, SG_INFO, "Saving flight");
-  ofstream output(file.c_str());
-  if (output.good() && fgSaveFlight(output, write_all)) {
-    output.close();
-    SG_LOG(SG_INPUT, SG_INFO, "Saved flight to " << file);
-    return true;
-  } else {
-    SG_LOG(SG_INPUT, SG_ALERT, "Cannot save flight to " << file);
-    return false;
-  }
+    string file = arg->getStringValue("file", "fgfs.sav");
+    if (file.size() < 4 || file.substr(file.size() - 4) != ".sav")
+        file += ".sav";
+
+    if (!fgValidatePath(file.c_str(), false)) {
+        SG_LOG(SG_IO, SG_ALERT, "save: reading '" << file << "' denied "
+                "(unauthorized access)");
+        return false;
+    }
+
+    bool write_all = arg->getBoolValue("write-all", false);
+    SG_LOG(SG_INPUT, SG_INFO, "Saving flight");
+    ofstream output(file.c_str());
+    if (output.good() && fgSaveFlight(output, write_all)) {
+        output.close();
+        SG_LOG(SG_INPUT, SG_INFO, "Saved flight to " << file);
+        return true;
+    } else {
+        SG_LOG(SG_INPUT, SG_ALERT, "Cannot save flight to " << file);
+        return false;
+    }
 }
 
 
@@ -1336,6 +1355,12 @@ do_load_xml_to_proptree(const SGPropertyNode * arg)
     if (file.extension() != "xml")
         file.concat(".xml");
 
+    if (!fgValidatePath(file.c_str(), false)) {
+        SG_LOG(SG_IO, SG_ALERT, "loadxml: reading '" << file.str() << "' denied "
+                "(unauthorized access)");
+        return false;
+    }
+
     SGPropertyNode *targetnode;
     if (arg->hasValue("targetnode"))
         targetnode = fgGetNode(arg->getStringValue("targetnode"), true);
@@ -1349,7 +1374,7 @@ do_load_xml_to_proptree(const SGPropertyNode * arg)
         return false;
     }
 
-    return  true;
+    return true;
 }
 
 
@@ -1376,6 +1401,12 @@ do_save_xml_from_proptree(const SGPropertyNode * arg)
     if (file.extension() != "xml")
         file.concat(".xml");
 
+    if (!fgValidatePath(file.c_str(), true)) {
+        SG_LOG(SG_IO, SG_ALERT, "savexml: writing to '" << file.str() << "' denied "
+                "(unauthorized access)");
+        return false;
+    }
+
     SGPropertyNode *sourcenode;
     if (arg->hasValue("sourcenode"))
         sourcenode = fgGetNode(arg->getStringValue("sourcenode"), true);