adam/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-08-06 16:53:34 +02:00
Code Issues Packages Projects Releases Wiki Activity

- merge trunc r1186:1187 into branch 1.6 (security in action.php)

Browse Source 
git-svn-id: http://piwigo.org/svn/branches/branch-1_6@1190 68402e56-0260-453c-a942-63ccdbb3a9ee
This commit is contained in:
chrisaga
2006-04-16 10:58:00 +00:00
parent e923145cec
commit c4f5086a07
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
action.php
+5 -2
View File
@@ -65,8 +65,11 @@ function force_download ($filename)
//--------------------------------------------------------- download big picture
if ( isset( $_GET['dwn'] ) )
{
//TODO : verify the path begins with './gallerie' and doesn't contains any '..'
// in order to avoid hacking atempts
//TODO : verify the path begins with something in galleries_url and that user has access rights to the picture
// in order to avoid hacking atempts by forged url
if (preg_match('/\.\./',$_GET['dwn'])) {
die('Hacking attempt!');
}
force_download($_GET['dwn']);
}