Parcourir la source

! Use the right variable when doing directory-traversal exploit prevention

Signed-off-by: Peter Spicer <[email protected]>
Peter Spicer il y a 10 ans
Parent
commit
f0afe3cc48
1 fichiers modifiés avec 1 ajouts et 1 suppressions
  1. 1 1
      Sources/Themes.php

+ 1 - 1
Sources/Themes.php

@@ -1687,7 +1687,7 @@ function EditTheme()
 				$_GET['directory'] = preg_replace(array('~^[\./\\:\0\n\r]+~', '~[\\\\]~', '~/[\./]+~'), array('', '/', '/'), $_GET['directory']);
 
 				$temp = realpath($currentTheme['theme_dir'] . '/' . $_GET['directory']);
-				if (empty($temp) || substr($temp, 0, strlen(realpath($theme_dir))) != realpath($theme_dir))
+				if (empty($temp) || substr($temp, 0, strlen(realpath($currentTheme['theme_dir']))) != realpath($currentTheme['theme_dir']))
 					$_GET['directory'] = '';
 			}
 		}