Fix a problem with call flows. Increase the security for both the xm_edit and the provision_editor.

2012-09-23 10:31:31 +00:00
parent 25259972f5
commit 1b781dd048
3 changed files with 20 additions and 8 deletions
@@ -25,6 +25,7 @@
 */
 include "root.php";
 require_once "includes/require.php";
+require_once "includes/checkauth.php";
 if (permission_exists('xml_editor_view')) {
 	//access granted
 }
@@ -33,7 +34,7 @@ else {
 	exit;
 }

-$filename = $_POST["file"];
+$filename = check_str($_POST["file"]);
 $filename = str_replace ("\\", "/", $filename);

 $handle = fopen($filename, "r");