tyler.durden/pandorafms
1
0
Fork 0
mirror of https://github.com/pandorafms/pandorafms.git synced 2025-07-31 01:35:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

Prepend folder to image to avoid Phar injection

Browse Source
This commit is contained in:
Luis Calvo 2020-01-22 10:17:35 +01:00
parent 475517afd7
commit ca35bb64cc
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
pandora_console/include/graphs/fgraph.php
View File

@ -57,6 +57,9 @@ switch ($graph_type) {
$out_of_lim_str = io_safe_output(get_parameter('out_of_lim_str', false)); $out_of_lim_str = io_safe_output(get_parameter('out_of_lim_str', false));
$out_of_lim_image = get_parameter('out_of_lim_image', false); $out_of_lim_image = get_parameter('out_of_lim_image', false);
// Add relative path to avoid phar object injection.
$out_of_lim_image = '../graphs/'.$out_of_lim_image;
$title = get_parameter('title'); $title = get_parameter('title');
$mode = get_parameter('mode', 1); $mode = get_parameter('mode', 1);