Deploy path traversal fix

prasathmani · Jan 25, 2023 · ae8ee64 · ae8ee64
1 parent dd1ba67
commit ae8ee64
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/tinyfilemanager.php b/tinyfilemanager.php
@@ -1065,6 +1065,15 @@ function get_file_path () {
     }
 
     $files = $_POST['file'];
+    $sanitized_files = array();
+
+    // clean path
+    foreach($files as $file){
+        array_push($sanitized_files, fm_clean_path($file));
+    }
+
+    $files = $sanitized_files;
+
     if (!empty($files)) {
         chdir($path);