Fix unvalidated password file path in Nginx module

ⓘ The password file path was taken from the request without any check, so it could point at any file on the system, which was then read or written.

It is now checked against the allowed directories, the same way it already is when the path is first set.

W1 and V4

nginx/edit_user.cgi

@@ -8,6 +8,9 @@ require './nginx-lib.pl';
 our (%text, %in, %access);
 &ReadParse();
 $in{'file'} || &error($text{'users_efile'});
+&can_directory($in{'file'}) || &error(&text('access_ecannot',
+		"<tt>".&html_escape($in{'file'})."</tt>",
+		"<tt>".&html_escape($access{'root'})."</tt>"));
 
 &switch_write_user(1);
 my $users = &htaccess_htpasswd::list_users($in{'file'});

nginx/list_users.cgi

@@ -8,6 +8,9 @@ require './nginx-lib.pl';
 our (%text, %in, %access);
 &ReadParse();
 $in{'file'} || &error($text{'users_efile'});
+&can_directory($in{'file'}) || &error(&text('access_ecannot',
+		"<tt>".&html_escape($in{'file'})."</tt>",
+		"<tt>".&html_escape($access{'root'})."</tt>"));
 
 &ui_print_header("<tt>".&html_escape($in{'file'})."</tt>",
 		 $text{'users_title'}, "");

nginx/save_user.cgi

@@ -9,6 +9,9 @@ our (%text, %in, %access);
 &ReadParse();
 &error_setup($text{'user_err'});
 $in{'file'} || &error($text{'users_efile'});
+&can_directory($in{'file'}) || &error(&text('access_ecannot',
+		"<tt>".&html_escape($in{'file'})."</tt>",
+		"<tt>".&html_escape($access{'root'})."</tt>"));
 
 # Get the user being edited
 &lock_file($in{'file'});