From 5de32d520bc7eee5ef400951130eef8a5cec9a2f Mon Sep 17 00:00:00 2001
From: Renato Botelho <garga@FreeBSD.org>
Date: Tue, 17 Jun 2014 13:46:01 -0300
Subject: [PATCH] Avoid directory traversal on restorefullbackup

---
 usr/local/www/system_firmware_restorefullbackup.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/usr/local/www/system_firmware_restorefullbackup.php b/usr/local/www/system_firmware_restorefullbackup.php
index 2cc57a08b8..7d635bf3fc 100644
--- a/usr/local/www/system_firmware_restorefullbackup.php
+++ b/usr/local/www/system_firmware_restorefullbackup.php
@@ -59,9 +59,9 @@ if($_GET['backupnow'])
 	mwexec_bg("/etc/rc.create_full_backup");
 
 if($_GET['downloadbackup']) {
-	$filename = $_GET['downloadbackup'];
+	$filename = basename($_GET['downloadbackup']);
 	$path = "/root/{$filename}";
-	if(file_exists("/root/{$filename}")) {
+	if(file_exists($path)) {
 		session_write_close();
 		ob_end_clean();
 		session_cache_limiter('public');