From 139e11df13f0beec2d9fd1ba37a7a8822278ca45 Mon Sep 17 00:00:00 2001 From: Kijin Sung Date: Tue, 15 Mar 2016 14:14:50 +0900 Subject: [PATCH] Also clean relative paths in cleanPath() --- common/framework/filters/filenamefilter.php | 4 ++++ common/framework/storage.php | 11 +++++++++++ 2 files changed, 15 insertions(+) create mode 100644 common/framework/storage.php diff --git a/common/framework/filters/filenamefilter.php b/common/framework/filters/filenamefilter.php index a498f2a98..becd5e3f7 100644 --- a/common/framework/filters/filenamefilter.php +++ b/common/framework/filters/filenamefilter.php @@ -55,6 +55,10 @@ class FilenameFilter */ public static function cleanPath($path) { + if (!preg_match('@^(?:[a-z]:[\\\\/]|\\\\|/)@i', $path)) + { + $path = \RX_BASEDIR . $path; + } $path = str_replace('\\', '/', $path); $path = preg_replace('@[\?#].+$@', '', $path); $path = preg_replace('@/{2,}@', '/', $path); diff --git a/common/framework/storage.php b/common/framework/storage.php new file mode 100644 index 000000000..4fee32b08 --- /dev/null +++ b/common/framework/storage.php @@ -0,0 +1,11 @@ +