Commit d51e0924 authored by Philippe Pary's avatar Philippe Pary
Browse files

Fixed security issue reported by Cédric on 8th march

parent e0c328e3
...@@ -136,7 +136,7 @@ case 'custcard': ...@@ -136,7 +136,7 @@ case 'custcard':
break; break;
case 'js': case 'js':
$file = $_GET['id']; $file = $_GET['id'];
$file = str_replace('..', '.', $file); $file = str_replace("..", "", $file);
require_once(PT::$ABSPATH . '/templates/' . $config['template'] . '/' . $file); require_once(PT::$ABSPATH . "/templates/" . $config['template'] . "/" . $file);
break; break;
} }
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment