lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX Yogosha report 4433 (backport)

Browse Source
This commit is contained in:
Alexandre SPANGARO 2020-09-16 21:31:46 +02:00
parent 6928b6543c
commit 254c391ddf
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/document.php
View File

@ -221,7 +221,7 @@ if (! $accessallowed)
if (preg_match('/\.\./', $fullpath_original_file) || preg_match('/[<>|]/', $fullpath_original_file)) if (preg_match('/\.\./', $fullpath_original_file) || preg_match('/[<>|]/', $fullpath_original_file))
{ {
dol_syslog("Refused to deliver file ".$fullpath_original_file); dol_syslog("Refused to deliver file ".$fullpath_original_file);
print "ErrorFileNameInvalid: ".$original_file; print "ErrorFileNameInvalid: ".dol_escape_htmltag($original_file);
exit; exit;
} }

2
htdocs/viewimage.php
View File

@ -232,7 +232,7 @@ if (! $accessallowed)
if (preg_match('/\.\./', $fullpath_original_file) || preg_match('/[<>|]/', $fullpath_original_file)) if (preg_match('/\.\./', $fullpath_original_file) || preg_match('/[<>|]/', $fullpath_original_file))
{ {
dol_syslog("Refused to deliver file ".$fullpath_original_file); dol_syslog("Refused to deliver file ".$fullpath_original_file);
print "ErrorFileNameInvalid: ".$original_file; print "ErrorFileNameInvalid: ".dol_escape_htmltag($original_file);
exit; exit;
} }