From b67dbc5fa85b71a61115aff3e5ff3dd576db3a40 Mon Sep 17 00:00:00 2001
From: Jean-Luc Cyr <me@jlcyr.com>
Date: Mon, 11 Jun 2018 18:43:26 -0400
Subject: [PATCH] Validate HTTP Method and secondary groups

---
 mod_absec.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 46 insertions(+), 9 deletions(-)

diff --git a/mod_absec.c b/mod_absec.c
index d4a4736..6ca7fce 100644
--- a/mod_absec.c
+++ b/mod_absec.c
@@ -64,6 +64,7 @@
 #include "apr_user.h"
 
 #include <pwd.h>
+#include <grp.h>
 #include <sys/types.h>
 #include <unistd.h>
 #include "apr_want.h"
@@ -95,6 +96,14 @@ static int absec_handler(request_rec *r)
         return DECLINED;
     }
 
+////////
+/* http method validate the perm asked (r/w vs get/post,put) */
+    ap_rprintf(r, "Method: %s<br/>\r\n", r->method);
+    int permmask = 0;
+    if (strcmp(r->method,"GET")==0) permmask=0444;     // r
+    if (strcmp(r->method,"PUT")==0) permmask=0222;     // w
+    if (strcmp(r->method,"POST")==0) permmask=0222;    // w
+    if (strcmp(r->method,"DELETE")==0) permmask=0111;  // x
 
 ////////
 /* check file permission on filesystem */
@@ -102,18 +111,28 @@ static int absec_handler(request_rec *r)
     struct stat fperm;
     int status;
     status = stat(r->filename, &fperm);
-    ap_rprintf(r, "File perms %o, owner %d, group %d (status %d)<br/>\r\n", fperm.st_mode, fperm.st_uid, fperm.st_gid, status);
+    //ap_rprintf(r, "File perms %o, owner %d, group %d (status %d)<br/>\r\n", fperm.st_mode, fperm.st_uid, fperm.st_gid, status);
 
-    // If file is world readable return content
-    if (fperm.st_mode & 0x4) {
-        ap_rprintf(r, "Fichier public<br/>\r\n");
+    /* check if any permission (ogw) match method (get r, put/post w, delete x) */
+    if ((fperm.st_mode & permmask)==0) {
+        /* no permission match, return don't even have to check user perms */
+        //ap_rprintf(r, "Aucune permission pour la methode %s (%o, %o)", r->method, fperm.st_mode, permmask);
+        return (OK);
+    }
+
+    // If file is world accessible for asked method return content
+    // TODO : if put/post/delete, must check BEFORE ACTION not AFTER!!!
+    if (fperm.st_mode & 0x7 & permmask) {
+        /* if so, return, no need to check user perms */
+        //ap_rprintf(r, "Fichier public<br/>\r\n");
         return (DECLINED);
     }
 
+////////
+/* Check if we have a basic auth user */
     const char* auth64p;
-    if (!r->header_only)
-        // Check if we have an auth header
-        auth64p = apr_table_get(r->headers_in,"Authorization");
+    // Check if we have an auth header
+    auth64p = apr_table_get(r->headers_in,"Authorization");
 
     // If no basic auth, ask for one
     if (auth64p==NULL) {
@@ -227,19 +246,37 @@ static int absec_handler(request_rec *r)
 
 
     // If file is user readable and user match return content
-    if ((fperm.st_uid==i) && (fperm.st_mode & 0400)) {
+    if ((fperm.st_uid==i) && (fperm.st_mode & 0700 & permmask)) {
         ap_rprintf(r, "Fichier propriétaire<br/>\r\n");
         return (DECLINED);
     }
 
     // If file is group readable and primary group match return content
-    if ((fperm.st_gid==g) && (fperm.st_mode & 0040)) {
+    if ((fperm.st_gid==g) && (fperm.st_mode & 0070 & permmask)) {
         ap_rprintf(r, "Fichier groupe<br/>\r\n");
         return (DECLINED);
     }
 
     // now check supplemental groups
     //ap_rprintf(r, "Fichier propriétaire %d %d %o %o<br/>\r\n", fperm.st_uid, i, fperm.st_mode, 0400);
+    gid_t grouplist[16];
+    int grouplistsize = 16;
+    int *groupreturn;
+    groupreturn = getgrouplist("jlcyr", g, grouplist, &grouplistsize);
+    if (groupreturn != -1) {
+        ap_rprintf(r, "OK liste des groupes (%d)<br/>\r\n", grouplistsize);
+        for (i=0; i<grouplistsize; i++) {
+            ap_rprintf(r, "group: %d\r\n", grouplist[i]);
+            // If file is group readable and match a supplemental group return content
+            if ((fperm.st_gid==grouplist[i]) && (fperm.st_mode & 0070 & permmask)) {
+                ap_rprintf(r, "Fichier groupe supplementaire<br/>\r\n");
+                return (DECLINED);
+            }
+        }
+    } else {
+        ap_rprintf(r, "Erreur<br/>\r\n");
+        return OK;
+    }
 
     // else decline
     ap_rprintf(r, "Aucuns droits de voir le fichier<br/>\r\n");