From 80875d91bbfa52553fe7bb2c1a32a9814880d9c1 Mon Sep 17 00:00:00 2001
From: Johannes Meyer <johannes.meyer@icinga.com>
Date: Mon, 12 Jul 2021 09:51:23 +0200
Subject: [PATCH] Merge pull request from GHSA-cmgc-h4cx-3v43

doc: Make sure to correctly access images
(cherry picked from commit 6c03c80f97fa66c0a2b36ce282cb4cef8854f215)
---
 modules/doc/application/controllers/ModuleController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/doc/application/controllers/ModuleController.php b/modules/doc/application/controllers/ModuleController.php
index 3b65b23b0..47dfb1c14 100644
--- a/modules/doc/application/controllers/ModuleController.php
+++ b/modules/doc/application/controllers/ModuleController.php
@@ -139,7 +139,7 @@ class ModuleController extends DocController
         $image = $this->params->getRequired('image');
         $docPath = $this->getPath($module, Icinga::app()->getModuleManager()->getModuleDir($module, '/doc'));
         $imagePath = realpath($docPath . '/' . $image);
-        if ($imagePath === false) {
+        if ($imagePath === false || substr($imagePath, 0, strlen($docPath)) !== $docPath) {
             $this->httpNotFound('%s does not exist', $image);
         }