← All changes | includes/Utils/Views.php +13 -1 4.4.0 → 4.9.2 View file →

		@@ -91,15 +91,27 @@
91	91
92	92	public function path( $name, $default = '' ) {
93	93	$this->_view_type = 'free';
94	94	$name = str_replace( $this->path, '', $name );
95		- $_filename = $this->path . $name . '.php';
96	95
	96	+ // Sanitize: strip any directory traversal sequences to prevent LFI.
	97	+ $name = str_replace( array( '../', '..\\' ), '', $name );
	98	+
	99	+ $_filename = $this->path . $name . '.php';
	100	+
97	101	if ( ! file_exists( $_filename ) ) {
98	102	$_filename = $this->path . $default . '.php';
99	103	}
100	104
101	105	if ( file_exists( $_filename ) ) {
	106	+ // Verify the resolved path stays within the plugin's base directory.
	107	+ $_real_path = realpath( $_filename );
	108	+ $_base_path = realpath( $this->path );
	109	+
	110	+ if ( $_real_path === false || $_base_path === false || strpos( $_real_path, $_base_path ) !== 0 ) {
	111	+ return null;
	112	+ }
	113	+
102	114	return $_filename;
103	115	}
104	116	}
105	117