From: Jo-Philipp Wich <jo@mein.io>
Date: Thu, 15 Mar 2018 10:46:54 +0000 (+0100)
Subject: uci: fix session delta isolation
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=6994c87a4213fce75f6545f08f7ee254d12623f2;p=oweals%2Frpcd.git

uci: fix session delta isolation

The libuci `uci_set_savedir()` function does not replace, but appends the
requested delta directory to the search path, this causes information leaks
between sessions.

Due to a lack of an official api for this, clear the uci contexts private
delta path before setting the save directory.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
---

diff --git a/uci.c b/uci.c
index 72ae5a6..bad9e16 100644
--- a/uci.c
+++ b/uci.c
@@ -210,8 +210,15 @@ rpc_uci_status(void)
 static void
 rpc_uci_set_savedir(struct blob_attr *sid)
 {
+	struct uci_element *e, *tmp;
 	char path[PATH_MAX];
 
+	uci_foreach_element_safe(&cursor->delta_path, tmp, e)
+		free(e);
+
+	cursor->delta_path.prev = &cursor->delta_path;
+	cursor->delta_path.next = &cursor->delta_path;
+
 	if (!sid)
 	{
 		uci_set_savedir(cursor, "/tmp/.uci");