diff --git a/module/editor/model.php b/module/editor/model.php index dec018f48c..37e9f3fc33 100644 --- a/module/editor/model.php +++ b/module/editor/model.php @@ -371,7 +371,11 @@ class editorModel extends model public function save($filePath) { $fileContent = $this->post->fileContent; + $evils = array('eval', 'exec', 'passthru', 'proc_open', 'shell_exec', 'system', '$$', 'include', 'require', 'assert'); + $gibbedEvils = array('e v a l', 'e x e c', ' p a s s t h r u', ' p r o c _ o p e n', 's h e l l _ e x e c', 's y s t e m', '$ $', 'i n c l u d e', 'r e q u i r e', 'a s s e r t'); + $fileContent = str_ireplace($gibbedEvils, $evils, $fileContent); if(get_magic_quotes_gpc()) $fileContent = stripslashes($fileContent); + $dirPath = dirname($filePath); $extFilePath = substr($filePath, 0, strpos($filePath, DS . 'ext' . DS) + 4); if(!is_dir($dirPath) and is_writable($extFilePath)) mkdir($dirPath, 0777, true);