Fix a security vulnerability for provisioning

2014-06-09 17:47:37 +00:00 · 2014-06-09 17:47:37 +00:00 · 3d86cbc7b7
parent 78288a156b
commit 3d86cbc7b7
1 changed files with 4 additions and 0 deletions
--- a/app/provision/resources/classes/provision.php
+++ b/app/provision/resources/classes/provision.php
@ -139,6 +139,10 @@ include "root.php";
 				$mac = $this->mac;
 				$file = $this->file;

+			//remove ../ and slashes in the file name
+				$search = array('..', '/', '\\');
+				$file = str_replace($search, "", $file);
+
 			//get the domain_name
 				if (strlen($domain_name) == 0) {
 					$sql = "SELECT domain_name FROM v_domains ";