VladPolskiy/webmin
1
0
Fork 0
mirror of https://github.com/webmin/webmin.git synced 2025-07-21 23:40:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix to resolve links before testing allowed path

Browse Source
This commit is contained in:
iliajie
2023-03-18 01:28:21 +02:00
parent b25d128665
commit 6e7eced812
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
filemin/download.cgi
View File

@ -9,7 +9,7 @@ use Cwd 'abs_path';
get_paths();
my $file = &simplify_path($cwd.'/'.$in{'file'});
my $file = &resolve_links(&simplify_path($cwd.'/'.$in{'file'}));
my $error = 1;
for $allowed_path (@allowed_paths) {
if (&is_under_directory($allowed_path, $file)) {