Skip to content
GitLab
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
Tommaso Perondi
ISPConfig 3
Commits
d09f4db5
Commit
d09f4db5
authored
Aug 17, 2018
by
Till Brehm
Browse files
Finetuning for
#5102
parent
6e094613
Changes
1
Hide whitespace changes
Inline
Side-by-side
interface/lib/classes/functions.inc.php
View file @
d09f4db5
...
...
@@ -480,9 +480,9 @@ class functions {
// Function to check paths before we use it as include. Use with absolute paths only.
public
function
check_include_path
(
$path
)
{
if
(
strpos
(
$path
,
'//'
))
die
(
'Include path seems to be an URL: '
.
$this
->
htmlentities
(
$path
));
if
(
strpos
(
$path
,
'..'
))
die
(
'Two dots are not allowed in include path: '
.
$this
->
htmlentities
(
$path
));
if
(
!
preg_match
(
"/^[a-zA-Z0-9_\/\.\-]
{
1,
}
$/"
,
$path
))
die
(
'Wrong chars in include path: '
.
$this
->
htmlentities
(
$path
));
if
(
strpos
(
$path
,
'//'
)
===
false
)
die
(
'Include path seems to be an URL: '
.
$this
->
htmlentities
(
$path
));
if
(
strpos
(
$path
,
'..'
)
===
false
)
die
(
'Two dots are not allowed in include path: '
.
$this
->
htmlentities
(
$path
));
if
(
!
preg_match
(
"/^[a-zA-Z0-9_\/\.\-]
+
$/"
,
$path
))
die
(
'Wrong chars in include path: '
.
$this
->
htmlentities
(
$path
));
$path
=
realpath
(
$path
);
if
(
$path
==
''
)
die
(
'Include path does not exist.'
);
if
(
substr
(
$path
,
0
,
strlen
(
ISPC_ROOT_PATH
))
!=
ISPC_ROOT_PATH
)
die
(
'Path '
.
$this
->
htmlentities
(
$path
)
.
' is outside of ISPConfig installation directory.'
);
...
...
@@ -495,7 +495,8 @@ class functions {
if
(
preg_match
(
'/^[a-z]{2}$/'
,
$language
))
{
return
$language
;
}
else
{
die
(
'Invalid language string: '
.
$this
->
htmlentities
(
$language
));
$app
->
log
(
'Wrong language string: '
.
$this
->
htmlentities
(
$language
),
1
);
return
'en'
;
}
}
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment