[svn r10707] Removal of security threat (until better solution is found) - see http://projects.dokeos.com/?do=details&id=1151

20 years ago · 366aa2f00b
parent 9d59c39e0e
commit 366aa2f00b
1 changed files with 3 additions and 2 deletions
--- a/main/exercice/hotspot_lang_conversion.php
+++ b/main/exercice/hotspot_lang_conversion.php
@ -5,8 +5,9 @@ $hotspot_lang_file = api_get_path(SYS_LANG_PATH);

 if(isset($_GET['lang']))
 {
-	if(file_exists($hotspot_lang_file . $_GET['lang'] . '/hotspot.inc.php'))
-		$hotspot_lang_file .= $_GET['lang'] . '/hotspot.inc.php';
+	$lang = str_replace('../','',urldecode($_GET['lang']));
+	if(file_exists($hotspot_lang_file . $lang . '/hotspot.inc.php'))
+		$hotspot_lang_file .= $lang . '/hotspot.inc.php';
 	else
 		$hotspot_lang_file .= 'english/hotspot.inc.php';
 }