diff options
| author |  Marien Fressinaud <dev@marienfressinaud.fr>
| 2014-12-05 10:51:34 +0100 |
|---|---|---|
| committer | Marien Fressinaud <dev@marienfressinaud.fr>
| 2014-12-05 10:54:44 +0100 |
| commit | a2da70fd119cc43438f8dd88de54a7d19fafbe1a (patch) | |
| tree | 7d7f2523760e12627c87b2a66de19d913ab1d366 /lib/Minz/ExtensionManager.php | |
| parent | f1fd1091b9ef0cb0818659e0ce1c9699506cac97 (diff) | |
Fix security hole from ext.php script.
Now, ext.php can only serve file under a EXTENSIONS_PATH/ext_dir/static/ directory.
A 400 Bad Request error will be returned for other files.
See https://github.com/FreshRSS/FreshRSS/issues/252
And https://github.com/FreshRSS/FreshRSS/commit/f9b037742a0aeb49cab86782d1a59913c2de47b
Diffstat (limited to 'lib/Minz/ExtensionManager.php')
0 files changed, 0 insertions, 0 deletions