Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2026-02-13 11:15:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

FIX #yogosha6944 Protection against traversal path.

Browse Source
This commit is contained in:
Laurent Destailleur
2021-08-23 15:47:18 +02:00
parent 21852bd16b
commit d46dfd017a
3 changed files with 18 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
htdocs/document.php
View File

@@ -195,7 +195,8 @@ if (!in_array($type, array('text/x-javascript')) && !dolIsAllowedForPreview($ori
}
// Security: Delete string ../ into $original_file
$original_file = str_replace("../", "/", $original_file);
$original_file = str_replace('../', '/', $original_file);
$original_file = str_replace('..\\', '/', $original_file);
// Find the subdirectory name as the reference
$refname = basename(dirname($original_file)."/");