Nemcio/VestaCP
1
0
Fork 0
mirror of https://github.com/serghey-rodin/vesta.git synced 2026-03-09 13:40:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #506 from Flatta/fix-sec-backup

Browse Source 
Fix #505: Strict backup filename check.
This commit is contained in:
Serghey Rodin
2015-12-11 21:48:23 +02:00
parent 9baea195fd dac0b5c686
commit 4dce22cd77
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
web/download/backup/index.php
View File

@@ -13,7 +13,7 @@ if ($_SESSION['user'] == 'admin') {
}
if ((!empty($_SESSION['user'])) && ($_SESSION['user'] != 'admin')) {
if (preg_match("/^".$user."/i", $backup)) {
if (strpos($backup, $user.'.') === 0) {
header('Content-type: application/gzip');
header("Content-Disposition: attachment; filename=\"".$backup."\";" );
header("X-Accel-Redirect: /backup/" . $backup);