* Merge module-editor 18.4-18.8 to Merge184.

2023-11-23 15:38:20 +08:00
parent 94a079cb3f
commit 27cb18bb03
1 changed files with 1 additions and 0 deletions
@@ -74,6 +74,7 @@ class editor extends control
        if($filePath)
        {
            $filePath = helper::safe64Decode($filePath);
+            $filePath = realpath($filePath);
            if(strpos(strtolower($filePath), strtolower($this->app->getBasePath())) !== 0) return print($this->lang->editor->editFileError);
            if($action == 'extendOther' and file_exists($filePath)) $this->view->showContent = file_get_contents($filePath);