[patch] Patch to disallow '..' in template and language filenames

phpsysinfo-2.1-urlencoded-security-fix.diff (text/plain), 503 bytes, created by Doug Weimer on 2003-10-12 12:39:41 UTC

--- phpSysInfo-2.1/index.php.old	2003-10-12 12:21:25.000000000 -0700
+++ phpSysInfo-2.1/index.php	2003-10-12 12:22:24.000000000 -0700
@@ -40,6 +40,14 @@
 
 define('APP_ROOT', dirname(__FILE__));
 
+if(isset($template) && preg_match("/\.\.|\//", $template)) {
+    $template='classic';
+}
+
+if (isset($lng) && preg_match("/\.\.|\//", $lng)) {
+    $lng = 'en';
+}
+
 // check to see if we have a random template first
 if (isset($template) && $template == 'random') {
     $dir = opendir('templates/');