WordPress.org

Make WordPress Core

Changeset 46476


Ignore:
Timestamp:
10/14/2019 03:29:25 PM (5 weeks ago)
Author:
whyisjake
Message:

Filesystem API: Prevent directory travelersals when creating new folders.

Reject file paths that contain sub-directory paths.

Props iandunn, xknown, sstoqnov, whyisjake.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/functions.php

    r46451 r46476  
    19221922    if ( file_exists( $target ) ) {
    19231923        return @is_dir( $target );
     1924    }
     1925
     1926    // Do not allow path traversals.
     1927    if ( false !== strpos( $target, '../' ) || false !== strpos( $target, '..' . DIRECTORY_SEPARATOR ) ) {
     1928        return false;
    19241929    }
    19251930
Note: See TracChangeset for help on using the changeset viewer.