Nemcio/simple-file-manager
1
0
Fork 0
mirror of https://github.com/jcampbell1/simple-file-manager.git synced 2025-02-20 22:00:04 +01:00
Code Issues Packages Projects Releases Activity

Merge pull request #17 from bk138/master

Browse Source 
Do not allow directory creation outside docroot.
This commit is contained in:
John Campbell
2016-01-14 11:30:52 -05:00
parent 0e0a25f1fa ad43b2a271
commit 82dd85779d
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
index.php
View File

@@ -70,6 +70,11 @@ if($_GET['do'] == 'list') {
rmrf($file);
exit;
} elseif ($_POST['do'] == 'mkdir') {
// don't allow actions outside root. we also filter out slashes to catch args like './../outside'
$dir = $_POST['name'];
$dir = str_replace('/', '', $dir);
if(substr($dir, 0, 2) === '..')
exit;
chdir($file);
@mkdir($_POST['name']);
exit;