b28c67
diff -up openwsman-2.6.8/src/server/shttpd/shttpd.c.orig openwsman-2.6.8/src/server/shttpd/shttpd.c
b28c67
--- openwsman-2.6.8/src/server/shttpd/shttpd.c.orig	2019-03-13 08:52:06.112090942 +0100
b28c67
+++ openwsman-2.6.8/src/server/shttpd/shttpd.c	2019-03-13 09:01:15.496156789 +0100
b28c67
@@ -336,10 +336,12 @@ date_to_epoch(const char *s)
b28c67
 }
b28c67
 
b28c67
 static void
b28c67
-remove_double_dots(char *s)
b28c67
+remove_all_leading_dots(char *s)
b28c67
 {
b28c67
 	char	*p = s;
b28c67
 
b28c67
+	while (*s != '\0' && *s == '.') s++;
b28c67
+
b28c67
 	while (*s != '\0') {
b28c67
 		*p++ = *s++;
b28c67
 		if (s[-1] == '/' || s[-1] == '\\')
b28c67
@@ -546,7 +548,7 @@ decide_what_to_do(struct conn *c)
b28c67
 		*c->query++ = '\0';
b28c67
 
b28c67
 	_shttpd_url_decode(c->uri, strlen(c->uri), c->uri, strlen(c->uri) + 1);
b28c67
-	remove_double_dots(c->uri);
b28c67
+	remove_all_leading_dots(c->uri);
b28c67
 
b28c67
 	root = c->ctx->options[OPT_ROOT];
b28c67
 	if (strlen(c->uri) + strlen(root) >= sizeof(path)) {
b28c67
@@ -556,6 +558,7 @@ decide_what_to_do(struct conn *c)
b28c67
 
b28c67
 	(void) _shttpd_snprintf(path, sizeof(path), "%s%s", root, c->uri);
b28c67
 
b28c67
+	DBG(("decide_what_to_do -> processed path: [%s]", path));
b28c67
 	/* User may use the aliases - check URI for mount point */
b28c67
 	if (is_alias(c->ctx, c->uri, &alias_uri, &alias_path) != NULL) {
b28c67
 		(void) _shttpd_snprintf(path, sizeof(path), "%.*s%s",
b28c67
@@ -572,7 +575,10 @@ decide_what_to_do(struct conn *c)
b28c67
 	if ((ruri = _shttpd_is_registered_uri(c->ctx, c->uri)) != NULL) {
b28c67
 		_shttpd_setup_embedded_stream(c,
b28c67
 		    ruri->callback, ruri->callback_data);
b28c67
-	} else
b28c67
+	} else {
b28c67
+		_shttpd_send_server_error(c, 403, "Forbidden");
b28c67
+	}
b28c67
+#if 0
b28c67
 	if (strstr(path, HTPASSWD)) {
b28c67
 		/* Do not allow to view passwords files */
b28c67
 		_shttpd_send_server_error(c, 403, "Forbidden");
b28c67
@@ -656,6 +662,7 @@ decide_what_to_do(struct conn *c)
b28c67
 	} else {
b28c67
 		_shttpd_send_server_error(c, 500, "Internal Error");
b28c67
 	}
b28c67
+#endif
b28c67
 }
b28c67
 
b28c67
 static int
b28c67
diff -up openwsman-2.6.8/src/server/wsmand.c.orig openwsman-2.6.8/src/server/wsmand.c
b28c67
--- openwsman-2.6.8/src/server/wsmand.c.orig	2018-10-12 12:06:26.000000000 +0200
b28c67
+++ openwsman-2.6.8/src/server/wsmand.c	2019-03-13 09:03:25.919181279 +0100
b28c67
@@ -198,6 +198,10 @@ static void daemonize(void)
b28c67
 	int fd;
b28c67
 	char *pid;
b28c67
 
b28c67
+	/* Change our CWD to / */
b28c67
+	i = chdir("/");
b28c67
+	assert(i == 0);
b28c67
+
b28c67
 	if (wsmand_options_get_foreground_debug() > 0) {
b28c67
 		return;
b28c67
 	}
b28c67
@@ -214,10 +218,6 @@ static void daemonize(void)
b28c67
 	log_pid = 0;
b28c67
 	setsid();
b28c67
 
b28c67
-	/* Change our CWD to / */
b28c67
-	i=chdir("/");
b28c67
-        assert(i == 0);
b28c67
-
b28c67
 	/* Close all file descriptors. */
b28c67
 	for (i = getdtablesize(); i >= 0; --i)
b28c67
 		close(i);