Permalink
Browse files

webserver: fix security issue which allowed accessing any file instea…

…d of only files from the webinterface
  • Loading branch information...
Montellese committed Nov 4, 2012
1 parent 52df23a commit bdff099c024521941cb0956fe01d99ab52a65335
Showing with 6 additions and 1 deletion.
  1. +6 −1 xbmc/network/httprequesthandler/HTTPWebinterfaceHandler.cpp
@@ -107,7 +107,12 @@ int CHTTPWebinterfaceHandler::ResolveUrl(const std::string &url, std::string &pa
}

if (addon)
path = URIUtils::AddFileToFolder(addon->Path(), path);
path = URIUtils::AddFileToFolder(addonPath, path);

string realPath = URIUtils::GetRealPath(path);
string realAddonPath = URIUtils::GetRealPath(addonPath);
if (!URIUtils::IsInPath(realPath, realAddonPath))
return MHD_HTTP_NOT_FOUND;

if (CDirectory::Exists(path))
{

0 comments on commit bdff099

Please sign in to comment.