Quote and newline-escape the arguments written into the --write-batch replay
script so a crafted filename cannot inject shell, and tighten rsync-ssl's option
handling.
- log: open the --log-file / daemon log file through
safe_open_no_attacker_symlinks() so a planted symlink can't redirect the
privileged log write;
- batch: open the --write-batch/--read-batch files the same way (+ an
S_ISREG check), and restore O_BINARY / an O_CLOEXEC fallback on the batch
opens.
Tests: log-file-symlink, batch-file-symlink.
Fix the code that writes the options and the default destination path
into the batch.sh file to be able to handle options being specified
after source/dest args.
- Improve function name: parse_rule -> parse_filter_str (to make the
similarity with parse_filter_file clearer, and better indicate that
it can parse multiple rules when FILTRULE_WORD_SPLIT is specified).
- In preparation for rule prefixes containing information beyond the
rflags, change the code to pass around a full "template" filter_rule
instead of just rflags. Callers of parse_filter_{str,file} that want
to specify only rflags can use rule_template(rflags) .
- Remove the MODIFIERS_* strings and instead hand-code the condition
under which each modifier is valid. This should make it easier to
see that the conditions are correct.
- Tighten up default modifiers on merge rules:
- Disallow "!" because it isn't useful.
- If the merge rule specifies a side via "s" or "r", the rules in the
file cannot also specify a side via "s", "r", "hide", etc.
[Patch was changed by Wayne a bit prior to application.]
were moved out of file_struct into an optional member-var setup.
- Renamed and reorganized the FLAG_* defines.
- Use NDX_DONE instead of a literal -1 when sending/checking the
end-of-phase index value.
- Standardized the format of the opening comment, including adding a
brief description of what's in the file for those that lacked it.
- Added some missing copyright lines.
- Some minor whitespace tweaks (in a few of the files).
Andrew Tridgell