From cc9d7445c3aa48961b80e98e1971b8061bfb343f Mon Sep 17 00:00:00 2001 From: Ralf Becker Date: Tue, 24 Mar 2009 17:19:38 +0000 Subject: [PATCH] "fix concat to allow filenames containing \"..\"" --- phpgwapi/inc/class.egw_vfs.inc.php | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/phpgwapi/inc/class.egw_vfs.inc.php b/phpgwapi/inc/class.egw_vfs.inc.php index 6497922f03..8a743f3d4c 100644 --- a/phpgwapi/inc/class.egw_vfs.inc.php +++ b/phpgwapi/inc/class.egw_vfs.inc.php @@ -1004,14 +1004,12 @@ class egw_vfs extends vfs_stream_wrapper $url = ($relative === '' || $relative[0] == '/' ? $url.$relative : $url.'/'.$relative); // now normalize the path (remove "/something/..") - while (strpos($url,'..') !== false) + while (strpos($url,'/../') !== false) { - list($a,$b) = explode('..',$url,2); + list($a,$b) = explode('/../',$url,2); $a = explode('/',$a); array_pop($a); - array_pop($a); $b = explode('/',$b); - if ($b[0] === '') array_shift($b); $url = implode('/',array_merge($a,$b)); } return $url.($query ? '?'.$query : '');