bernd commited on 2008-08-08 19:32:53
Zeige 2 geänderte Dateien mit 10 Einfügungen und 3 Löschungen.
git-svn-id: https://svn.schokokeks.org/repos/tools/webinterface/trunk@1129 87cf0b9e-d624-0410-a070-f6ee81989793
| ... | ... |
@@ -8,7 +8,14 @@ $go = $_GET['go']; |
| 8 | 8 |
sanitize $go |
| 9 | 9 |
*/ |
| 10 | 10 |
|
| 11 |
-if (strstr($go, "..") or strstr($go, "./") or strstr($go, ":") or (! file_exists("modules/$go")) or (! is_file("modules/$go")))
|
|
| 11 |
+// filenames can end with .php |
|
| 12 |
+if ( substr( $go, strlen( $go ) - 4 ) == '.php' ) {
|
|
| 13 |
+ $go = substr( $go, 0, strlen($go) - 4); |
|
| 14 |
+} |
|
| 15 |
+ |
|
| 16 |
+DEBUG($go); |
|
| 17 |
+ |
|
| 18 |
+if (strstr($go, "..") or strstr($go, "./") or strstr($go, ":") or (! file_exists("modules/$go.php")) or (! is_file("modules/$go.php")))
|
|
| 12 | 19 |
{
|
| 13 | 20 |
die("illegal command");
|
| 14 | 21 |
} |
| ... | ... |
@@ -43,7 +50,7 @@ ini_set('include_path',ini_get('include_path').':./modules/'.dirname($go).'/incl
|
| 43 | 50 |
$section = str_replace("/", "_", str_replace(".php", "", $go));
|
| 44 | 51 |
|
| 45 | 52 |
/* Let the module work */ |
| 46 |
-include("modules/".$go);
|
|
| 53 |
+include("modules/".$go.".php");
|
|
| 47 | 54 |
|
| 48 | 55 |
|
| 49 | 56 |
include('inc/top.php');
|