mbirth/LuckyCoinkydink
1
0
Fork 0
Code Issues Pull Requests Activity

Add additional check for allowed feed tpls (#431)

Browse Source
This commit is contained in:
onli 2016-12-14 12:43:50 +01:00
parent cb03731e90
commit e9f98f80f0
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
rss.php
View File

@ -20,6 +20,13 @@ $comments = FALSE;
if (empty($version)) {
list($version) = serendipity_discover_rss($_GET['file'], $_GET['ext']);
} else {
# be sure it is an allowed version, to prevent attackers sniffing for unrelated files on the file system
$allowed_versions = ['opml1.0', '0.91', '1.0', '2.0', 'atom0.3', 'atom1.0'];
if (! in_array($version, $allowed_versions)) {
header('Status: 404 Not Found');
exit;
}
}
if (isset($_GET['category'])) {