gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/master'

Browse Source
This commit is contained in:
Weblate 2013-10-03 16:17:46 +02:00
commit 4bcb90fe67
1 changed files with 4 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
js/get_scripts.js.php
View File

@ -9,10 +9,6 @@
chdir('..');
// Avoid loading the full common.inc.php because this would add many
// non-js-compatible stuff like DOCTYPE
define('PMA_MINIMUM_COMMON', true);
require_once './libraries/common.inc.php';
// Close session early as we won't write anything there
session_write_close();
@ -28,11 +24,9 @@ if (! empty($_GET['scripts']) && is_array($_GET['scripts'])) {
$path = explode("/", $script);
foreach ($path as $index => $filename) {
if (! preg_match("@^\.+$@", $filename)
&& preg_match("@^[\w\.-]+$@", $filename)
) {
// Disallow "." and ".." alone
// Allow alphanumeric, "." and "-" chars only
// Allow alphanumeric, "." and "-" chars only, no files starting
// with .
if (preg_match("@^[\w][\w\.-]+$@", $filename)) {
$script_name .= DIRECTORY_SEPARATOR . $filename;
}
}
@ -45,7 +39,7 @@ if (! empty($_GET['scripts']) && is_array($_GET['scripts'])) {
}
}
if ($_GET['call_done']) {
if (isset($_GET['call_done'])) {
echo "AJAX.scriptHandler.done();";
}
?>