Changeset 46482 for branches/5.2

Timestamp:

10/14/2019 04:12:33 PM (7 years ago)

Author:

whyisjake

Message:

Filesystem API: Prevent directory travelersals when creating new folders.

Reject file paths that contain sub-directory paths.

Backports [46476] to the 5.2 branch.

Props iandunn, xknown, sstoqnov, whyisjake.

Location:

branches/5.2

Files:

• . (modified) (1 prop)
• src/wp-includes/functions.php (modified) (1 diff)

branches/5.2/src/wp-includes/functions.php

@@ -1786 +1786 @@
         if ( file_exists( $target ) ) {
                 return @is_dir( $target );
+        }
+
+        // Do not allow path traversals.
+        if ( false !== strpos( $target, '../' ) || false !== strpos( $target, '..' . DIRECTORY_SEPARATOR ) ) {
+                return false;
         }