mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Avoid directory traversal on restorefullbackup

Browse Source
This commit is contained in:
Renato Botelho 2014-06-17 13:46:01 -03:00
parent b67cdd05ab
commit 5de32d520b
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
usr/local/www/system_firmware_restorefullbackup.php
View File

@ -59,9 +59,9 @@ if($_GET['backupnow'])
mwexec_bg("/etc/rc.create_full_backup");
if($_GET['downloadbackup']) {
$filename = $_GET['downloadbackup'];
$filename = basename($_GET['downloadbackup']);
$path = "/root/{$filename}";
if(file_exists("/root/{$filename}")) {
if(file_exists($path)) {
session_write_close();
ob_end_clean();
session_cache_limiter('public');