[web-doc] master: allowlist for tutorial filename characters

Author: Peter Cowburn (salathe) Date: 2021-07-27T14:34:47+01:00 Commit: https://github.com/php/web-doc/commit/e0d5dd0a6fb1b13b6f3bada396efc0cd37f947a8 Raw diff: https://github.com/php/web-doc/commit/e0d5dd0a6fb1b13b6f3bada396efc0cd37f947a8.diff allowlist for tutorial filename characters Changed paths: M www/tutorial.php Diff: diff --git a/www/tutorial.php b/www/tutorial.php index 776ea6c..0b17685 100644 --- a/www/tutorial.php +++ b/www/tutorial.php @@ -4,8 +4,8 @@ $parsedown = new Parsedown(); $chapter = isset($_GET['chapter']) ? $_GET['chapter'] : 'intro'; -$path = '../tutorial/'.str_replace('..', '', $chapter).'.md'; -// Very simple check against local file inclusion, maybe it could be done better way? +$chapter = preg_replace("/[^a-z0-9-]/", "", $chapter); +$path = '../tutorial/' . $chapter . '.md'; if (file_exists($path)) { $content = file_get_contents($path);