tyler.durden/icingaweb2
1
0
Fork 0
mirror of https://github.com/Icinga/icingaweb2.git synced 2025-07-28 08:14:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request from GHSA-cmgc-h4cx-3v43

Browse Source 
doc: Make sure to correctly access images
(cherry picked from commit 6c03c80f97fa66c0a2b36ce282cb4cef8854f215)
This commit is contained in:
Johannes Meyer 2021-07-12 09:51:23 +02:00
parent ffe8741c66
commit 80875d91bb
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
modules/doc/application/controllers/ModuleController.php
View File

@ -139,7 +139,7 @@ class ModuleController extends DocController
$image = $this->params->getRequired('image');
$docPath = $this->getPath($module, Icinga::app()->getModuleManager()->getModuleDir($module, '/doc'));
$imagePath = realpath($docPath . '/' . $image);
if ($imagePath === false) {
if ($imagePath === false || substr($imagePath, 0, strlen($docPath)) !== $docPath) {
$this->httpNotFound('%s does not exist', $image);
}