post-W7 cleanup

src/fastcgi/src/fcgicc.cc

@@ -812,12 +812,20 @@ FastCGIServer::process_http_request(FastCGIRequest& request, String& data)
 
 	if(resolve_http_script_filename && request.params["SCRIPT_FILENAME"] == "" && request.params["DOCUMENT_URI"] != "")
 	{
-		String document_root = http_script_root();
+		String document_root = first(http_document_root, http_script_root());
 		String document_uri = strip_leading_slashes(request.params["DOCUMENT_URI"]);
+		for(String part : split(document_uri, "/"))
+		{
+			if(part == "..")
+			{
+				reject_http_connection(*client_sockets[request.resources.client_socket], "HTTP/1.1 404 Not Found", "script not found\n");
+				return;
+			}
+		}
 		String candidate = path_join(document_root, document_uri);
 		String real_root = path_real(document_root);
 		String real_candidate = path_real(candidate);
-		if(real_root == "" || real_candidate == "" || !path_is_within(candidate, document_root))
+		if(real_root == "" || real_candidate == "" || !path_is_within(real_candidate, real_root))
 		{
 			reject_http_connection(*client_sockets[request.resources.client_socket], "HTTP/1.1 404 Not Found", "script not found\n");
 			return;

src/fastcgi/src/fcgicc.h

@@ -62,6 +62,7 @@ public:
 	void process_forever();
 	int calls_until_termination = 8; // set this to -1 to never terminate
 	bool resolve_http_script_filename = true;
+	String http_document_root = "";
 
 	typedef unsigned RequestID;
 	typedef std::map<RequestID, FastCGIRequest*> RequestList;

src/linux_fastcgi.cpp

@@ -982,6 +982,7 @@ void run_ws_broker()
 	close_inherited_server_sockets();   // drop the worker listeners we inherited
 	install_process_fault_handlers();
 	ws_broker.calls_until_termination = -1;
+	ws_broker.http_document_root = first(server_state.config["HTTP_DOCUMENT_ROOT"], path_join(server_state.config["COMPILER_SYS_PATH"], server_state.config["SITE_DIRECTORY"]));
 	// The broker renders nothing itself, so accept every request through to
 	// on_complete (it either forwards to the pool or applies a ws_* batch).
 	ws_broker.on_request = [](FastCGIRequest&) { return 0; };