[IMPORTANT SECURITY] Fix critical directory traversal vulnerability i…

…n file seeding mechanism
tinelix · Jun 14, 2020 · cf6cda2 · cf6cda2
1 parent 02dd373
commit cf6cda2
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/Web/Presenters/BlobPresenter.php b/Web/Presenters/BlobPresenter.php
@@ -17,6 +17,7 @@ private function getDirName($dir): string
     function renderFile(/*string*/ $dir, string $name, string $format)
     {
         $dir  = $this->getDirName($dir);
+        $name = preg_replace("%[^a-zA-Z0-9_\-]++%", "", $name);
         $path = OPENVK_ROOT . "/storage/$dir/$name.$format";
         if(!file_exists($path)) {
             $this->notFound();