rygel r43 - in trunk: . src

[zeeshanak svn gnome org]

Author: zeeshanak
Date: Tue Oct 28 20:58:59 2008
New Revision: 43
URL: http://svn.gnome.org/viewvc/rygel?rev=43&view=rev

Log:
Quick security fix: only host the user's home dir.

This should be OK with most tracker setups since by default tracker only
indexes user's home dir.

Modified:
   trunk/ChangeLog
   trunk/src/gupnp-media-tracker.c

Modified: trunk/src/gupnp-media-tracker.c
==============================================================================
--- trunk/src/gupnp-media-tracker.c	(original)
+++ trunk/src/gupnp-media-tracker.c	Tue Oct 28 20:58:59 2008
@@ -31,9 +31,6 @@
 
 #include "gupnp-media-tracker.h"
 
-#define ROOT_DIR       "/"
-#define ROOT_DIR_ALIAS "/media"
-
 #define TRACKER_SERVICE "org.freedesktop.Tracker"
 #define TRACKER_PATH "/org/freedesktop/tracker"
 
@@ -156,6 +153,7 @@
         GObjectClass *object_class;
         GUPnPMediaTracker *tracker;
         DBusGConnection *connection;
+        const char *home_dir;
         GError *error;
 
         object_class = G_OBJECT_CLASS (gupnp_media_tracker_parent_class);
@@ -211,10 +209,12 @@
                 goto error_case;
         }
 
-        /* Host the system root dir */
+        home_dir = g_get_home_dir ();
+
+        /* Host the home dir of the user */
         gupnp_context_host_path (tracker->priv->context,
-                                 ROOT_DIR,
-                                 ROOT_DIR_ALIAS);
+                                 home_dir,
+                                 home_dir);
 
         return object;
 
@@ -521,10 +521,9 @@
                                             "/",
                                             TRUE);
         /* URI */
-        res.uri = g_strdup_printf ("http://%s:%d%s%s";,
+        res.uri = g_strdup_printf ("http://%s:%d%s";,
                                    gupnp_context_get_host_ip (context),
                                    gupnp_context_get_port (context),
-                                   ROOT_DIR_ALIAS,
                                    escaped_path);
         g_free (escaped_path);