From 5ab3d3c821df9dbe713fd2d4750b3968de3a3b74 Mon Sep 17 00:00:00 2001
From: David Aspinall <da@inf.ed.ac.uk>
Date: Thu, 13 Sep 2001 15:55:18 +0000
Subject: Fix two more gaping holes letting people examine whole filesystem
 (also fixed in server anyway)

---
 html/smallpage.php | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

(limited to 'html')

diff --git a/html/smallpage.php b/html/smallpage.php
index 64f538a3..ef165c6d 100644
--- a/html/smallpage.php
+++ b/html/smallpage.php
@@ -1,6 +1,12 @@
 <?php
   require('functions.php3');
   small_header($title);
-  include($file);
+  if (substr($file,0,1)=="." or 
+      substr($file,0,1)=="/" or
+      substr($file,0,1)=="~") {
+     print "Sorry, can't show you that file!\n"; 
+  } else {
+    include($file);
+  }
   footer(); 
 ?>
-- 
cgit v1.2.3