Skip to content
Snippets Groups Projects
Commit cf2658cd authored by Olav Morken's avatar Olav Morken
Browse files

module.php: Be more paranoid when verifying paths.

Cannot see a way that this can be used to escape the module www
directory, but being more specific in the test won't hurt.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2961 44740490-163a-0410-bde0-09ae8108e29a
parent 0b854969
No related branches found
No related tags found
No related merge requests found
...@@ -75,9 +75,9 @@ try { ...@@ -75,9 +75,9 @@ try {
* URL will detect both '../' and './'. Searching for '\' will detect attempts to * URL will detect both '../' and './'. Searching for '\' will detect attempts to
* use Windows-style paths. * use Windows-style paths.
*/ */
if (strpos($url, '\\')) { if (strpos($url, '\\') !== FALSE) {
throw new SimpleSAML_Error_BadRequest('Requested URL contained a backslash.'); throw new SimpleSAML_Error_BadRequest('Requested URL contained a backslash.');
} elseif (strpos($url, './')) { } elseif (strpos($url, './') !== FALSE) {
throw new SimpleSAML_Error_BadRequest('Requested URL contained \'./\'.'); throw new SimpleSAML_Error_BadRequest('Requested URL contained \'./\'.');
} }
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment