From ad43b2a2714c4fba243eeac1a29d040ebd80a79d Mon Sep 17 00:00:00 2001
From: Christian Beier <dontmind@freeshell.org>
Date: Thu, 14 Jan 2016 17:05:32 +0100
Subject: [PATCH] Do not allow directory creation outside docroot.

---
 index.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/index.php b/index.php
index 4b652f3..9c4f67d 100644
--- a/index.php
+++ b/index.php
@@ -70,6 +70,11 @@ if($_GET['do'] == 'list') {
 	rmrf($file);
 	exit;
 } elseif ($_POST['do'] == 'mkdir') {
+	// don't allow actions outside root. we also filter out slashes to catch args like './../outside'
+	$dir = $_POST['name'];
+	$dir = str_replace('/', '', $dir);
+	if(substr($dir, 0, 2) === '..')
+	    exit;
 	chdir($file);
 	@mkdir($_POST['name']);
 	exit;