security fix: submitDomainCreation

Author: usmannasir

websiteFunctions/website.py

@@ -261,6 +261,9 @@ def submitDomainCreation(self, userID=None, data=None):
             else:
                 return ACLManager.loadErrorJson('createWebSiteStatus', 0)
 
+            if data['path'].find('..') > -1:
+                return ACLManager.loadErrorJson('createWebSiteStatus', 0)
+
             if currentACL['admin'] != 1:
                 data['openBasedir'] = 1