Update share.php template

pydio · Dec 12, 2014 · 0ee7677 · 0ee7677
1 parent adcc9f5
commit 0ee7677
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/core/src/plugins/action.share/class.ShareStore.php b/core/src/plugins/action.share/class.ShareStore.php
@@ -47,12 +47,14 @@ public function __construct($downloadFolder, $hashMinLength = 32){
     private function createGenericLoader(){
         if(!is_file($this->downloadFolder."/share.php")){
             $loader_content = '<'.'?'.'php
-                    $hash = $_GET["hash"];
+                    define("AJXP_EXEC", true);
+                    require_once("'.str_replace("\\", "/", AJXP_INSTALL_PATH).'/core/classes/class.AJXP_Utils.php");
+                    $hash = AJXP_Utils::securePath(AJXP_Utils::sanitize($_GET["hash"], AJXP_SANITIZE_ALPHANUM));
                     if(file_exists($hash.".php")){
                         require_once($hash.".php");
                     }else{
                         require_once("'.str_replace("\\", "/", AJXP_INSTALL_PATH).'/publicLet.inc.php");
-                        ShareCenter::loadShareByHash($_GET["hash"]);
+                        ShareCenter::loadShareByHash($hash);
                     }
                 ';
             if (@file_put_contents($this->downloadFolder."/share.php", $loader_content) === FALSE) {