I solved some issues with Directory traversal

2015-03-26 14:55:51 -04:00
parent c2d32d4f59
commit f4664ce34c
3 changed files with 43 additions and 13 deletions
--- a/workflow/engine/methods/cases/casesStreamingFile.php
+++ b/workflow/engine/methods/cases/casesStreamingFile.php
@@ -54,6 +54,9 @@ exit;

 function rangeDownload($location,$mimeType)
 {
+    G::LoadSystem('inputfilter');
+    $filter = new InputFilter();
+    $location = $filter->xssFilterHard($location, "path");
    if (!file_exists($location))
    {
        header ("HTTP/1.0 404 Not Found");