Avoid possible path traversal using MySQL username

Signed-off-by: Michal Čihař <michal@cihar.com>
2016-06-30 10:04:46 +02:00 · 2016-06-30 10:04:46 +02:00 · c6cfb58834
commit c6cfb58834
parent e46fdb8e5e
1 changed files with 1 additions and 1 deletions
--- a/libraries/Util.class.php
+++ b/libraries/Util.class.php
@ -2659,7 +2659,7 @@ class PMA_Util
            $dir .= '/';
        }

-        return str_replace('%u', $GLOBALS['cfg']['Server']['user'], $dir);
+        return str_replace('%u', PMA_securePath($GLOBALS['cfg']['Server']['user']), $dir);
    }

    /**