Security Fix

unilogies · Feb 23, 2023 · 256f254 · 256f254
1 parent 927214b
commit 256f254
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/theme/rui/invoice-print.php b/theme/rui/invoice-print.php
@@ -105,7 +105,7 @@
         if (isset($_GET["invoiceType"]) and !empty($_GET["invoiceType"])) {
 
 
-            $invoicePage = DIR_MODULE . "invoice/{$_GET['invoiceType']}.php";
+            $invoicePage = DIR_MODULE . "invoice/". basename("{$_GET['page']}.php");
 
             if (file_exists($invoicePage)) {
                 require $invoicePage;

diff --git a/theme/rui/print.php b/theme/rui/print.php
@@ -99,7 +99,9 @@
         } 
 
         if(isset($_GET["page"]) and !empty($_GET["page"])) {
-            $printPage = DIR_MODULE . "print/{$_GET['page']}.php";
+
+
+            $printPage = DIR_MODULE . "print/". basename("{$_GET['page']}.php");
 
             if(file_exists($printPage)) {
                 require $printPage;