cvs: phpweb / source.php
| From: | Gabor Hojtsy | Date: | Fri, 14 Nov 2003 11:59:03 +0000 |
| Subject: | cvs: phpweb / source.php | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-22010@lists.php.net to get a copy of this message | ||
goba Fri Nov 14 06:59:03 2003 EDT
Modified files:
/phpweb source.php
Log:
Better check on what is intended to be viewed
Index: phpweb/source.php
diff -u phpweb/source.php:1.22 phpweb/source.php:1.23
--- phpweb/source.php:1.22 Sun Aug 31 08:55:43 2003
+++ phpweb/source.php Fri Nov 14 06:59:03 2003
@@ -1,5 +1,5 @@
<?php
-// $Id: source.php,v 1.22 2003/08/31 12:55:43 goba Exp $
+// $Id: source.php,v 1.23 2003/11/14 11:59:03 goba Exp $
$_SERVER['BASE_PAGE'] = 'source.php';
include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc';
@@ -61,7 +61,7 @@
"/error" => 1,
"/license" => 1
);
- if (preg_match("!^/manual/!", $dir) || isset($legal_dirs[$dir])) {
+ if ((preg_match("!^/manual/!", $dir) || isset($legal_dirs[$dir])) &&
strpos($dir, "..") === FALSE) {
$page_name = $_SERVER['DOCUMENT_ROOT'] . $_GET['url'];
} else { $page_name = FALSE; }
} else {