Changeset 46476

Timestamp:

10/14/2019 03:29:25 PM (5 years ago)

Author:

whyisjake

Message:

Filesystem API: Prevent directory travelersals when creating new folders.

Reject file paths that contain sub-directory paths.

Props iandunn, xknown, sstoqnov, whyisjake.

File:

• trunk/src/wp-includes/functions.php (modified) (1 diff)

trunk/src/wp-includes/functions.php

@@ -1922 +1922 @@
     if ( file_exists( $target ) ) {
         return @is_dir( $target );
+    }
+
+    // Do not allow path traversals.
+    if ( false !== strpos( $target, '../' ) || false !== strpos( $target, '..' . DIRECTORY_SEPARATOR ) ) {
+        return false;
     }