[geeklog-cvs] geeklog-1.3/system/classes downloader.class.php,1.5,1.6

[tony at iowaoutdoors.org]

Update of /var/cvs/geeklog-1.3/system/classes
In directory www:/tmp/cvs-serv26316

Modified Files:
	downloader.class.php 
Log Message:
downloadFIle() now verifies path locations using realpath() to ensure someone isn't trying to access a file outside of the configured directory.

Index: downloader.class.php
===================================================================
RCS file: /var/cvs/geeklog-1.3/system/classes/downloader.class.php,v
retrieving revision 1.5
retrieving revision 1.6
diff -C2 -d -r1.5 -r1.6
*** downloader.class.php	11 Jan 2004 19:16:10 -0000	1.5
--- downloader.class.php	9 Jun 2004 18:19:35 -0000	1.6
***************
*** 482,487 ****
  	{
          // Ensure file exists        
!         if(!is_file($this->_sourceDirectory . $fileName)) {
!             $this->_addError('Specified file ' . $this->_sourceDirectory . $fileName . ' does not exist');
              return false;
          }
--- 482,488 ----
  	{
          // Ensure file exists        
!         if(!is_file(($this->_sourceDirectory . $fileName)) OR
!             (dirname($this->_sourceDirectory) <> dirname(realpath($this->_sourceDirectory . $fileName)))) {
!             $this->_addError('Specified file ' . $this->_sourceDirectory . $fileName . ' does not exist or is not accessible');
              return false;
          }