Marien Fressinaud a2da70fd11 Fix security hole from ext.php script. ...

Now, ext.php can only serve file under a EXTENSIONS_PATH/ext_dir/static/ directory.
A 400 Bad Request error will be returned for other files.

See https://github.com/FreshRSS/FreshRSS/issues/252
And https://github.com/FreshRSS/FreshRSS/commit/f9b037742a0aeb49cab86782d1a59913c2de47b

2014-12-05 10:54:44 +01:00

1.7 KiB

Raw Blame History

View Raw