From 2dcce5b399b986a70ed61c9655521559235865ed Mon Sep 17 00:00:00 2001
From: Lisa Milne <lisamilne618@gmail.com>
Date: Sun, 3 Dec 2023 13:23:28 +1000
Subject: [PATCH] add missing permissions check in vfs mk*()

---
 clite/core.js | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/clite/core.js b/clite/core.js
index f756224..27edb82 100644
--- a/clite/core.js
+++ b/clite/core.js
@@ -1624,6 +1624,17 @@ clite.vfs = {
 				return true;
 			return false;
 		}
+		function checkCanWrite(uid,node) {
+			if (!uid)
+				return true;
+			if (node.perms[8] == 'w')
+				return true;
+			if (clite.user.checkGID(uid,node.gid) && node.perms[5] == 'w')
+				return true;
+			if (node.uid == uid && node.perms[2] == 'w')
+				return true;
+			return false;
+		}
 		function mkNode() {
 			var fsnode = {
 				name: '',
@@ -1697,6 +1708,8 @@ clite.vfs = {
 			var parent = vfsdata.api.getNode(uid,dir);
 			if (!parent || !parent.data.isdir)
 				return false;
+			if (!checkCanWrite(uid,parent))
+				return false;
 			var n = mkNode();
 			n.name = name;
 			n.data.parent = parent;
@@ -1719,6 +1732,8 @@ clite.vfs = {
 			var parent = vfsdata.api.getNode(0,dir);
 			if (!parent || !parent.data.isdir)
 				return false;
+			if (!checkCanWrite(uid,parent))
+				return false;
 			var n = mkNode();
 			n.name = name;
 			n.data.parent = parent;
@@ -1740,6 +1755,8 @@ clite.vfs = {
 			var parent = vfsdata.api.getNode(uid,dir);
 			if (!parent || !parent.data.isdir)
 				return false;
+			if (!checkCanWrite(uid,parent))
+				return false;
 			var n = mkNode();
 			n.name = name;
 			n.data.parent = parent;