diff --git a/libraries/common.lib.php b/libraries/common.lib.php index 38d4d5fd3..d0a24e193 100644 --- a/libraries/common.lib.php +++ b/libraries/common.lib.php @@ -238,25 +238,6 @@ if ($is_minimum_common == FALSE) { function PMA_generateHiddenMaxFileSize($max_size){ return ''; } - /** - * Removes insecure parts in a path; used before include() or - * require() when a part of the path comes from an insecure source - * like a cookie or form. - * - * @param string The path to check - * - * @return string The secured path - * - * @access public - * @author Marc Delisle (lem9@users.sourceforge.net) - */ - function PMA_securePath($path) { - - // change .. to . - $path = preg_replace('@\.\.*@','.',$path); - - return $path; - } // end function /** * Charset conversion. @@ -269,6 +250,26 @@ if ($is_minimum_common == FALSE) { require_once('./libraries/string.lib.php'); } +/** + * Removes insecure parts in a path; used before include() or + * require() when a part of the path comes from an insecure source + * like a cookie or form. + * + * @param string The path to check + * + * @return string The secured path + * + * @access public + * @author Marc Delisle (lem9@users.sourceforge.net) + */ +function PMA_securePath($path) { + + // change .. to . + $path = preg_replace('@\.\.*@','.',$path); + + return $path; +} // end function + // If zlib output compression is set in the php configuration file, no // output buffering should be run if (@ini_get('zlib.output_compression')) { @@ -317,8 +318,7 @@ if (!isset($_COOKIE['pma_theme']) || empty($_COOKIE['pma_theme'])){ $GLOBALS['theme'] = $_COOKIE['pma_theme']; if ($_COOKIE['pma_theme'] != 'original') { $pmaThemeImage = './' . $cfg['ThemePath'] . '/' . $_COOKIE['pma_theme'] . '/img/'; - //$tmp_color_file = './' . $cfg['ThemePath'] . '/' . PMA_securePath($_COOKIE['pma_theme']) . '/colors.inc.php'; - $tmp_color_file = './' . $cfg['ThemePath'] . '/' . $_COOKIE['pma_theme'] . '/colors.inc.php'; + $tmp_color_file = './' . $cfg['ThemePath'] . '/' . PMA_securePath($_COOKIE['pma_theme']) . '/colors.inc.php'; if (@file_exists($tmp_color_file)) { include($tmp_color_file); }