#!/bin/bash

# this script has to be run chrooted as apache/www-data !!!

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

SAFEPATH=/usr/lib/safeexec

[ `id -u` -eq 33 ] || { echo "ERROR: This script has to be run as www-data (uid 33)!"; exit 9; }

[ -z $SAFEPATH ] && { logger -t saferun "ERROR: SAFEPATH not defined."; exit 10; }
[ -d $SAFEPATH ] || { logger -t saferun "ERROR: SAFEPATH doesn't exist."; exit 11; }

read -e LINE

# trim special characters
LINE="$(echo -n "$LINE"|tr -d '\r\n\f')"

DCMD="${LINE%% *}"
DARGS="${LINE#* }"

[ "$DARGS" == "$LINE" ] && DARGS=""

#CMD=${DCMD//\.\./}
CMD=${DCMD//[^a-zA-Z0-9-_\.]/}

# clean .., &&, ||, %%
ARGS=${DARGS//\.\./}
ARGS=${ARGS//\&\&/}
ARGS=${ARGS//\|\|/}
ARGS=${ARGS//\%\%/}
# clean special characters
#ARGS=${ARGS//[\#\;\`\|\*\?\~\^\$\!\<\>\(\)\[\]\{\}\\]/}
ARGS=${ARGS//[\#\`\|\~\^\$]/}

# only these characters can remain (extra safety, might be disabled)
#ARGS=${ARGS//[^a-zA-Z0-9-_ \.\"\&\/\=\%\:\+]/}

if [ "x$DCMD" != "x$CMD" ]; then
    echo "ERROR: Invalid characters in command: $DCMD ($CMD)"
    logger -t saferun "ERROR: Invalid executable: [$LINE]"
    exit 13;
fi

if [ -z $CMD ]; then
    echo "ERROR: Nothing to run."
    logger -t saferun "NORUN: Nothing to run.";
    exit 12;
fi

if ! [ -x "$SAFEPATH/$CMD" ]; then
    echo "ERROR: Executable doesn't exist: $SAFEPATH/$CMD"
    logger -t saferun "NORUN: Executable doesn't exist: $SAFEPATH/$CMD"
    exit 14
fi

if [ "x$DARGS" != "x$ARGS" ]; then
    echo "ERROR: Invalid characters in arguments."
    echo "[Input] $DARGS"
    echo "[Output] $ARGS"
    logger -t saferun "ERROR: Invalid args: [$LINE]"
    exit 13;
fi

#debug
logger -t saferun "Running: $SAFEPATH/$CMD args: $ARGS"

#exec "$SAFEPATH/$CMD" $ARGS #2>/dev/null
#eval "$SAFEPATH/$CMD" $ARGS #2>/dev/null
echo "$ARGS" |xargs $SAFEPATH/$CMD

exit 0