Merge pull request atutor#116 from stevenseeley/patch-9

Update view_transcript.php, added basename() to prevent abitrary file reading
Fucntion · Mar 24, 2016 · 5da4de6 · 5da4de6
2 parents cbfe7a1 + 1019731
commit 5da4de6
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/mods/_standard/chat/manage/view_transcript.php b/mods/_standard/chat/manage/view_transcript.php
@@ -14,7 +14,7 @@
 require(AT_INCLUDE_PATH.'vitals.inc.php');
 
 
-$file = AT_CONTENT_DIR . 'chat/'.$_SESSION['course_id'].'/tran/'.$_GET['t'].'.html';
+$file = AT_CONTENT_DIR . 'chat/'.$_SESSION['course_id'].'/tran/'.basename($_GET['t']).'.html';
 if (!file_exists($file)) {
  $msg->addError('FILE_NOT_FOUND');
  header('Location: index.php');
@@ -24,4 +24,4 @@
 @readfile($file);
 echo '</table>';
 require(AT_INCLUDE_PATH.'footer.inc.php');
-?>
+?>