From fb58b7e93090e69df3a8975fa766b429dd3ab374 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 22 Feb 2022 18:46:46 +0100 Subject: [PATCH] FIX #yogosha9048 --- htdocs/website/class/website.class.php | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/htdocs/website/class/website.class.php b/htdocs/website/class/website.class.php index 0e66e01db01..80a48048151 100644 --- a/htdocs/website/class/website.class.php +++ b/htdocs/website/class/website.class.php @@ -655,6 +655,13 @@ class Website extends CommonObject dol_syslog(__METHOD__, LOG_DEBUG); + $newref = dol_sanitizeFileName($newref); + + if (empty($newref)) { + $this->error = 'ErrorBadParameter'; + return -1; + } + $object = new self($this->db); // Check no site with ref exists @@ -671,8 +678,8 @@ class Website extends CommonObject $oldidforhome = $object->fk_default_home; $oldref = $object->ref; - $pathofwebsiteold = $dolibarr_main_data_root.'/website/'.$oldref; - $pathofwebsitenew = $dolibarr_main_data_root.'/website/'.$newref; + $pathofwebsiteold = $dolibarr_main_data_root.'/website/'.dol_sanitizeFileName($oldref); + $pathofwebsitenew = $dolibarr_main_data_root.'/website/'.dol_sanitizeFileName($newref); dol_delete_dir_recursive($pathofwebsitenew); $fileindex = $pathofwebsitenew.'/index.php';