Skip to content

Commit 0d279ac

Browse files
committed
update
1 parent babf280 commit 0d279ac

File tree

2 files changed

+15
-2
lines changed

2 files changed

+15
-2
lines changed

Diff for: src/MicroweberPackages/App/functions/other.php

+14
Original file line numberDiff line numberDiff line change
@@ -1211,3 +1211,17 @@ function mergeScreenshotParts($files, $outputFilename = 'full-screenshot.png')
12111211
imagepng($targetImage, $outputFilename, 8);
12121212
}
12131213
}
1214+
if (!function_exists('sanitize_path')) {
1215+
1216+
function sanitize_path($path)
1217+
{
1218+
$path = str_replace('..', '', $path);
1219+
$path = str_replace('./', '', $path);
1220+
$path = str_replace('.\\', '', $path);
1221+
$path = str_replace(';', '', $path);
1222+
$path = str_replace('&&', '', $path);
1223+
$path = str_replace('|', '', $path);
1224+
$path = str_replace('>', '', $path);
1225+
return $path;
1226+
}
1227+
}

Diff for: src/MicroweberPackages/App/functions/plupload.php

+1-2
Original file line numberDiff line numberDiff line change
@@ -285,8 +285,7 @@
285285
//$path = str_replace('%25252F','/',$path);
286286

287287
$path = normalize_path($path, 0);
288-
289-
$path = str_replace('..', '', $path);
288+
$path = sanitize_path($path);
290289
$path = str_replace($path_restirct, '', $path);
291290

292291
// $target_path = userfiles_path() . DS . $path;

0 commit comments

Comments
 (0)