bernd commited on 2008-08-08 19:32:53
Zeige 2 geänderte Dateien mit 10 Einfügungen und 3 Löschungen.
git-svn-id: https://svn.schokokeks.org/repos/tools/webinterface/trunk@1129 87cf0b9e-d624-0410-a070-f6ee81989793
... | ... |
@@ -8,7 +8,14 @@ $go = $_GET['go']; |
8 | 8 |
sanitize $go |
9 | 9 |
*/ |
10 | 10 |
|
11 |
-if (strstr($go, "..") or strstr($go, "./") or strstr($go, ":") or (! file_exists("modules/$go")) or (! is_file("modules/$go"))) |
|
11 |
+// filenames can end with .php |
|
12 |
+if ( substr( $go, strlen( $go ) - 4 ) == '.php' ) { |
|
13 |
+ $go = substr( $go, 0, strlen($go) - 4); |
|
14 |
+} |
|
15 |
+ |
|
16 |
+DEBUG($go); |
|
17 |
+ |
|
18 |
+if (strstr($go, "..") or strstr($go, "./") or strstr($go, ":") or (! file_exists("modules/$go.php")) or (! is_file("modules/$go.php"))) |
|
12 | 19 |
{ |
13 | 20 |
die("illegal command"); |
14 | 21 |
} |
... | ... |
@@ -43,7 +50,7 @@ ini_set('include_path',ini_get('include_path').':./modules/'.dirname($go).'/incl |
43 | 50 |
$section = str_replace("/", "_", str_replace(".php", "", $go)); |
44 | 51 |
|
45 | 52 |
/* Let the module work */ |
46 |
-include("modules/".$go); |
|
53 |
+include("modules/".$go.".php"); |
|
47 | 54 |
|
48 | 55 |
|
49 | 56 |
include('inc/top.php'); |