This patch does the following:

  1. Updates the DRUPAL-5 branch to work under Drupal 6
  2. Adds a bunch of t() functions to status messages
  3. Prevents "jah error" message from appearing when users do not have download privileges
  4. Restrict all fileshare node base paths to be within the Drupal 'files' hierarchy only

See SA-2008-004 - Fileshare - Arbitrary code execution.

There were already some post SA updates in CVS that were meant to address the security vulnerability. But apparently they were not sufficient, since the module is still unpublished. Therefore support for assigning arbitrary base paths is removed by this patch. Privileged users may still assign base paths, provided they are within the 'files' hierarchy.

CommentFileSizeAuthor
#1 fileshare-D5toD6.patch42.11 KBjchan

Comments

jchan’s picture

jchan commented
StatusFileSize
new fileshare-D5toD6.patch42.11 KB
wdouglascampbell’s picture

wdouglascampbell commented

What is the status on this? Patch seems good. Can we unblock the Fileshare module now?

glottus’s picture

glottus commented

Also interested in the status of this module with this patch. As an alternative, can anyone help explain how this module differs from the Filebrowser module? I haven't seen Fileshare in action, but have a potential need to upgrade from an older version of this to Drupal 6.

Marvine’s picture

Marvine commented

Hi,

I am also interested by this module in Drupal 6 but I haven't the original code of Fileshare in Drupal 5.

Could you provide us the Drupal 6 code of this module with the patch applied or the Drupal 5 code ?

wdouglascampbell’s picture

wdouglascampbell commented

Check out CVS: http://drupalcode.org/viewvc/drupal/contributions/modules/fileshare/

Marvine’s picture

Marvine commented

Thank you.

Not better, the patch works wrong with this sources ...

So the module is not ok in Drupal 6 :( .

iannakin’s picture

iannakin commented
Issue summary: View changes

If some of you are still interrested, I created an issue for a port in D6 and D7 that I wrote.
It's here : Port of fileshare in D7 and D6