Local file inclusion vulnerability

2011-07-07 14:50:37 -04:00
parent 951fb4dd79
commit f63e1bb42a
2 changed files with 2 additions and 1 deletions
--- a/sql.php
+++ b/sql.php
@@ -719,7 +719,7 @@ if (0 == $num_rows || $is_affected) {
            parse_str($_REQUEST['transform_fields_list'], $edited_values);

            foreach($mime_map as $transformation) {
-                $include_file = $transformation['transformation'];
+                $include_file = PMA_securePath($transformation['transformation']);
                $column_name = $transformation['column_name'];
                $column_data = $edited_values[$column_name];