From 5d5c7f6d8f072d14926fc2c3a97cdd763802f170 Mon Sep 17 00:00:00 2001
From: azett <githubregistrierung@azett.com>
Date: Sun, 25 Dec 2022 15:00:06 +0100
Subject: [PATCH] fixes #179, preventing path traversal

---
 fp-plugins/mediamanager/panels/panel.mediamanager.file.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fp-plugins/mediamanager/panels/panel.mediamanager.file.php b/fp-plugins/mediamanager/panels/panel.mediamanager.file.php
index 331a32b..cb33c48 100644
--- a/fp-plugins/mediamanager/panels/panel.mediamanager.file.php
+++ b/fp-plugins/mediamanager/panels/panel.mediamanager.file.php
@@ -77,6 +77,8 @@ class admin_uploader_mediamanager extends AdminPanelAction {
 		/* delete file */
 		if (isset($_GET ['deletefile'])) {
 			list ($type, $name) = explode("-", $_GET ['deletefile'], 2);
+			// prevent path traversal: remove ".." and "/" resp. "\"
+			$name = preg_replace('(\.\.|\/|\\\\)', '', $name);
 			switch ($type) {
 				case 'attachs':
 					$type = ABS_PATH . ATTACHS_DIR;