From b958a2d30c69434e1a2b8be927100e16c6eb4554 Mon Sep 17 00:00:00 2001
From: Adam Ierymenko <adam.ierymenko@gmail.com>
Date: Mon, 19 May 2014 16:13:42 +0000
Subject: [PATCH] Redis schema updates and fix for GitHub issue #72

---
 netconf-service/redis-schema.md |  2 ++
 node/SoftwareUpdater.cpp        | 12 +++++++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/netconf-service/redis-schema.md b/netconf-service/redis-schema.md
index 9dc4dc5b7..48c530f42 100644
--- a/netconf-service/redis-schema.md
+++ b/netconf-service/redis-schema.md
@@ -38,6 +38,7 @@ Note: users are referred to elsewhere in the database by their compound key \<au
 - R lastLogin :: timestamp of last login
 - R creationTime: :: timestamp of account creation
 - M displayName :: usually First Last, defaults to e-mail address for 'local' auth and whatever the OpenID API says for third party auth such as Google.
+- M defaultCard :: ID of default credit card (actual card objects are stored by Stripe, not in this database)
 - R stripeCustomerId :: customer ID for Stripe credit card service if the user has cards on file (we don't store cards, we let Stripe do that)
 
 ## Networks
@@ -63,6 +64,7 @@ Each network has a network record indexed by its 64-bit network ID in lower-case
 - M v4AssignPool :: network/bits from which to assign IPs
 - M v6AssignMode :: 'none' (or null/empty/etc.), 'zt', 'v6native', 'dhcp6'
 - M v6AssignPool :: network/bits from which to assign IPs
+- M subscriptions :: comma-delimited list of subscriptions for this network
 - M ui :: string-serialized JSON blob for use by the user interface, ignored by netconf-master
 
 ### zt1:network:\<nwid\>:member:\<address\>:~
diff --git a/node/SoftwareUpdater.cpp b/node/SoftwareUpdater.cpp
index 7cb0d4792..02da55db2 100644
--- a/node/SoftwareUpdater.cpp
+++ b/node/SoftwareUpdater.cpp
@@ -201,7 +201,17 @@ void SoftwareUpdater::_cbHandleGetLatestVersionBinary(void *arg,int code,const s
 		return;
 	}
 	std::string updatesDir(_r->homePath + ZT_PATH_SEPARATOR_S + "updates.d");
-	std::string updatePath(updatesDir + ZT_PATH_SEPARATOR_S + url.substr(lastSlash + 1));
+	std::string updateFilename(url.substr(lastSlash + 1));
+	for(std::string::iterator c(updateFilename.begin());c!=updateFilename.end();++c) {
+		// Only allow a list of whitelisted characters to make up the filename to prevent any
+		// path shenanigans, esp on Windows where / is not the path separator.
+		if (!strchr("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_.0123456789",*c)) {
+			LOG("software update failed: invalid URL: filename contains invalid characters");
+			upd->_status = UPDATE_STATUS_IDLE;
+			return;
+		}
+	}
+	std::string updatePath(updatesDir + ZT_PATH_SEPARATOR_S + updateFilename);
 #ifdef __WINDOWS__
 	CreateDirectoryA(updatesDir.c_str(),NULL);
 #else