N°6989 - Security hardening

Combodo · Nov 22, 2023 · 3b2da39 · 3b2da39
1 parent fc22d91
commit 3b2da39
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/pages/exec.php b/pages/exec.php
@@ -48,8 +48,9 @@
 
 $sTargetPage = APPROOT.'env-'.$sEnvironment.'/'.$sModule.'/'.$sPage;
 
-if (!file_exists($sTargetPage))
-{
+if (!file_exists($sTargetPage)
+    || (strtolower(pathinfo($sTargetPage, PATHINFO_EXTENSION)) !== "php")
+) {
 	// Do not recall the parameters (security takes precedence)
 	echo "Wrong module, page name or environment...";
 	exit;