diff --git a/main/inc/ajax/admin.ajax.php b/main/inc/ajax/admin.ajax.php index f420971e8a..8b2b3c47e3 100755 --- a/main/inc/ajax/admin.ajax.php +++ b/main/inc/ajax/admin.ajax.php @@ -61,18 +61,16 @@ switch ($action) { } if (!is_dir($newUrlDir)) { - @mkdir($newUrlDir, api_get_permissions_for_new_directories(), true); + mkdir($newUrlDir, api_get_permissions_for_new_directories(), true); } - $fullFilePath = "{$newUrlDir}{$blockName}_extra.html"; - - if (file_exists($fullFilePath)) { - @unlink($fullFilePath); + if (!is_writable($newUrlDir)) { + die; } - @touch($fullFilePath); + $fullFilePath = "{$newUrlDir}{$blockName}_extra.html"; - @file_put_contents($fullFilePath, $content); + file_put_contents($fullFilePath, $content); break; @@ -99,9 +97,15 @@ switch ($action) { $newUrlDir = api_get_path(SYS_PATH) . "home/admin/"; } - if (Security::check_abs_path("{$newUrlDir}{$blockName}_extra.html", $newUrlDir)) { - echo @file_get_contents("{$newUrlDir}{$blockName}_extra.html"); + if (!Security::check_abs_path("{$newUrlDir}{$blockName}_extra.html", $newUrlDir)) { + die; } + + if (!file_exists("{$newUrlDir}{$blockName}_extra.html")) { + die; + } + + echo file_get_contents("{$newUrlDir}{$blockName}_extra.html"); break; }