From 08cc7f673c377bf88897743e340097e93f1e95f4 Mon Sep 17 00:00:00 2001
From: ftimme <ft@falkotimme.com>
Date: Wed, 16 Jan 2013 09:30:05 -0500
Subject: [PATCH] - Changed regex for redirect path (Web sites, subdomains, vhost subdomains, alias domains) and web folder (vhost subdomains) so that ".." is not allowed (in order to prevent path traversals). - nginx: don't allow folders for proxy redirects (subdomains and alias domains); URL is required. - nginx: modified rewriting.
---
interface/lib/classes/tpl.inc.php | 9 ++++++++-
1 files changed, 8 insertions(+), 1 deletions(-)
diff --git a/interface/lib/classes/tpl.inc.php b/interface/lib/classes/tpl.inc.php
index 3bd310f..72d0dfe 100644
--- a/interface/lib/classes/tpl.inc.php
+++ b/interface/lib/classes/tpl.inc.php
@@ -878,8 +878,15 @@
*/
private function _fileSearch($file)
{
- $filename = basename($file);
+
+ $filename = basename($file);
$filepath = dirname($file);
+
+ if(isset($_SESSION['s']['module']['name']) && isset($_SESSION['s']['theme'])) {
+ if(is_file(ISPC_THEMES_PATH.'/'.$_SESSION['s']['theme'].'/templates/'.$_SESSION['s']['module']['name'].'/'.$filename)) {
+ return ISPC_THEMES_PATH.'/'.$_SESSION['s']['theme'].'/templates/'.$_SESSION['s']['module']['name'].'/'.$filename;
+ }
+ }
//* check fullpath first..
$fullpath = $filepath.'/'.$filename;
--
Gitblit v1.9.1