[VD:LocalFileSystem] fix #1514 security vulnerability in the archive command

2026-06-08 12:37:09 +00:00 · 2016-07-11 10:46:03 +09:00
parent 8383a2dd28
commit b4525d4965
1 changed files with 3 additions and 0 deletions
@@ -784,6 +784,9 @@ class elFinderVolumeLocalFileSystem extends elFinderVolumeDriver {
 		$cwd = getcwd();
 		chdir($dir);
 		
+		foreach($files as $i => $file) {
+			$files[$i] = '.'.DIRECTORY_SEPARATOR.$file;
+		}
 		$files = array_map('escapeshellarg', $files);
 		
 		$cmd = $arc['cmd'].' '.$arc['argc'].' '.escapeshellarg($name).' '.implode(' ', $files);