| @@ -91,27 +91,15 @@ | ||
| 91 | 91 | |
| 92 | 92 | public function path( $name, $default = '' ) { |
| 93 | 93 | $this->_view_type = 'free'; |
| 94 | 94 | $name = str_replace( $this->path, '', $name ); |
| 95 | + $_filename = $this->path . $name . '.php'; | |
| 95 | 96 | |
| 96 | - // Sanitize: strip any directory traversal sequences to prevent LFI. | |
| 97 | - $name = str_replace( array( '../', '..\\' ), '', $name ); | |
| 98 | - | |
| 99 | - $_filename = $this->path . $name . '.php'; | |
| 100 | - | |
| 101 | 97 | if ( ! file_exists( $_filename ) ) { |
| 102 | 98 | $_filename = $this->path . $default . '.php'; |
| 103 | 99 | } |
| 104 | 100 | |
| 105 | 101 | if ( file_exists( $_filename ) ) { |
| 106 | - // Verify the resolved path stays within the plugin's base directory. | |
| 107 | - $_real_path = realpath( $_filename ); | |
| 108 | - $_base_path = realpath( $this->path ); | |
| 109 | - | |
| 110 | - if ( $_real_path === false || $_base_path === false || strpos( $_real_path, $_base_path ) !== 0 ) { | |
| 111 | - return null; | |
| 112 | - } | |
| 113 | - | |
| 114 | 102 | return $_filename; |
| 115 | 103 | } |
| 116 | 104 | } |
| 117 | 105 | |
