[Noalyss-commit] [noalyss] 09/13: security

[Dany De Bontridder]

sparkyx pushed a commit to branch master
in repository noalyss.

commit 43f35352aa2a40892a1369a15062145bdc4bcb68
Author: sparkyx <danydb@noalyss.eu>
AuthorDate: Sun Aug 29 10:59:01 2021 +0200

    security
---
 html/export.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/html/export.php b/html/export.php
index 9b5044c..b26a20f 100644
--- a/html/export.php
+++ b/html/export.php
@@ -49,7 +49,7 @@ if ( $action=='X'  || $g_user->check_print($action)==0 )
 // get file and execute it
 
  $prfile=$cn->get_value("select me_file from menu_ref where 
me_code=$1",array($action));
- if ( $prfile == "") {
+ if ( $prfile == "" || !file_exists(NOALYSS_INCLUDE."/export/$prfile")) {
      print $action;
      die (_('Export impossible'));
  }