Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2026-02-08 00:52:01 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix #yogosha7494

Browse Source
This commit is contained in:
Laurent Destailleur
2021-10-22 10:49:01 +02:00
parent 8ba05cc242
commit 962aa9f977
2 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/document.php
View File

@@ -195,9 +195,11 @@ if (!in_array($type, array('text/x-javascript')) && !dolIsAllowedForPreview($ori
}
// Security: Delete string ../ or ..\ into $original_file
$original_file = preg_replace('/\.\.+/','..', $original_file); // Replace '... or more' with '..'
$original_file = str_replace('../', '/', $original_file);
$original_file = str_replace('..\\', '/', $original_file);
// Find the subdirectory name as the reference
$refname = basename(dirname($original_file)."/");