Commit 9e922068 authored by Greg Knaddison's avatar Greg Knaddison
Browse files

Perform extra validation prior to creating directories/files

parent 4c3fa8d1

src/EventSubscriber/ProxySubscriber.php

+5 −0
Original line number Diff line number Diff line
@@ -85,6 +85,11 @@ class ProxySubscriber implements EventSubscriberInterface { 
      return;

    }



    // Disallow directory traversal.

    if (in_array('..', explode('/', $request_path))) {

      return;

    }



    $alter_excluded_paths_event = new AlterExcludedPathsEvent([]);

    $this->eventDispatcher->dispatch('stage_file_proxy.alter_excluded_paths', $alter_excluded_paths_event);

    $excluded_paths = $alter_excluded_paths_event->getExcludedPaths();