mirror/FreshRSS
0
0
Fork 0
mirror of https://github.com/FreshRSS/FreshRSS.git synced 2026-07-17 02:22:52 -04:00
Code Issues Packages Projects Releases Wiki Activity

Use realpath of EXTENSIONS_PATH (#1911)

Browse Source 
This handles the case where the extensions directory might be a symlink
This commit is contained in:
Girish Ramakrishnan
2018-06-01 14:19:24 -07:00
committed by Alexandre Alapetite
parent 4c8f147238
commit fa3532dc8e
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
p/ext.php
View File

@@ -19,13 +19,14 @@ require(__DIR__ . '/../constants.php');
*/
function is_valid_path($path) {
// It must be under the extension path.
$in_ext_path = (substr($path, 0, strlen(EXTENSIONS_PATH)) === EXTENSIONS_PATH);
$real_ext_path = realpath(EXTENSIONS_PATH);
$in_ext_path = (substr($path, 0, strlen($real_ext_path)) === $real_ext_path);
if (!$in_ext_path) {
return false;
}
// File to serve must be under a `ext_dir/static/` directory.
$path_relative_to_ext = substr($path, strlen(EXTENSIONS_PATH) + 1);
$path_relative_to_ext = substr($path, strlen($real_ext_path) + 1);
$path_splitted = explode('/', $path_relative_to_ext);
if (count($path_splitted) < 3 || $path_splitted[1] !== 'static') {
return false;