security update

silvanmelchior · Feb 20, 2022 · 2c74da5 · 2c74da5
1 parent aafe930
commit 2c74da5
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 7 deletions.
diff --git a/README.md b/README.md
@@ -1,5 +1,5 @@
 Web based interface for controlling the Raspberry Pi Camera, includes motion detection, time lapse, and image and video recording.
-Current version 6.6.23
+Current version 6.6.24
 All information on this project can be found here: http://www.raspberrypi.org/forums/viewtopic.php?f=43&t=63276
 
 The wiki page can be found here:

diff --git a/www/config.php b/www/config.php
@@ -3,7 +3,7 @@
 	define('LBASE_DIR',dirname(__FILE__));
 	//Global defines and utility functions
 	// version string 
-	define('APP_VERSION', 'v6.6.23');
+	define('APP_VERSION', 'v6.6.24');
 
 	// name of this application
 	define('APP_NAME', 'RPi Cam Control');

diff --git a/www/index.php b/www/index.php
@@ -207,11 +207,12 @@ function simple_button() {
    }
 
    if (isset($_POST['extrastyle'])) {
-      if (file_exists('css/' . $_POST['extrastyle'])) {
-         $fp = fopen(BASE_DIR . '/css/extrastyle.txt', "w");
-         fwrite($fp, $_POST['extrastyle']);
-         fclose($fp);
-      }
+	  $extra = $_POST['extrastyle'];
+      if ((strpos($extra, '/') === false) && file_exists('css/' . $extra)) {
+		 $fp = fopen(BASE_DIR . '/css/extrastyle.txt', "w");
+		 fwrite($fp, $extra);
+		 fclose($fp);
+	  }
    }
 
    function getDisplayStyle($context, $userLevel) {