Fixing big security issue in render_file that allows accessing any fi…

…les from outside public folder using ../ Improved security behaviour will be added later (with a safe_dir option). [#35 state:resolved]
sofadesign · Nov 30, 2009 · c99be76 · c99be76
1 parent dbe688d
commit c99be76
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/lib/limonade.php b/lib/limonade.php
@@ -1468,6 +1468,7 @@ function render_file($filename, $return = false)
   // {
   //   
   // }
+  $filename = str_replace('../', '', $filename);
   if(file_exists($filename))
   {
     $content_type = mime_type(file_extension($filename));