diff options
| author | Michael Hamann <michael@content-space.de> | 2012-07-08 19:21:37 +0200 |
|---|---|---|
| committer | Michael Hamann <michael@content-space.de> | 2012-07-08 19:21:37 +0200 |
| commit | d867cca366d1a7aa106bec98db52a2b416b10c26 (patch) | |
| tree | 173ca2417ee6d011c378da5518f728abf2a1b83c /inc/farm.php | |
| parent | 0990161c720c6b5202a59a91e3b7aa172374f277 (diff) | |
| download | rpg-d867cca366d1a7aa106bec98db52a2b416b10c26.tar.gz rpg-d867cca366d1a7aa106bec98db52a2b416b10c26.tar.bz2 | |
Check that the animal is actually inside the farm
This makes sure that the animal that is specified in the URL is actually
a subdirectory inside the farm and not somewhere else in the system.
This allows that the animals are organized in different subdirectories
for more complicated farm setups.
Diffstat (limited to 'inc/farm.php')
| -rw-r--r-- | inc/farm.php | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/inc/farm.php b/inc/farm.php index 8434e3067..51b0c0f78 100644 --- a/inc/farm.php +++ b/inc/farm.php @@ -46,6 +46,9 @@ function conf_path($farm) { if(isset($_REQUEST['animal']) || ('cli' == php_sapi_name() && isset($_SERVER['animal']))) { $mode = isset($_REQUEST['animal']) ? 'htaccess' : 'cli'; $animal = $mode == 'htaccess' ? $_REQUEST['animal'] : $_SERVER['animal']; + // check that $animal specifies a subdirectory of $farm + if (strpos(fullpath($farm.'/'.$animal), fullpath($farm).'/') !== 0) + nice_die('Sorry! Invalid Wiki name!'); if(!is_dir($farm.'/'.$animal)) nice_die("Sorry! This Wiki doesn't exist!"); if(!defined('DOKU_FARM')) define('DOKU_FARM', $mode); |