admin/Studio-42-elFinder
1
0
Fork 0
mirror of https://github.com/Studio-42/elFinder synced 2026-06-08 12:37:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prevents files outside the root from being detected.

Browse Source
This commit is contained in:
Beanow
2013-03-21 14:55:48 +01:00
parent 7f59c1382e
commit b51bddd50c
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
php/elFinderVolumeLocalFileSystem.class.php
+5
View File
@@ -263,6 +263,11 @@ class elFinderVolumeLocalFileSystem extends elFinderVolumeDriver {
return $stat;
}
//Verifies the given path is the root or is inside the root. Prevents directory traveral.
if($path !== $this->root && strpos(realpath($path), realpath($this->root).DIRECTORY_SEPARATOR) !== 0){
return $stat;
}
if ($path != $this->root && is_link($path)) {
if (($target = $this->readlink($path)) == false
|| $target == $path) {