From 2751bb20289be15b16f66569bbca0c34d80131fe Mon Sep 17 00:00:00 2001
From: Niklas Bittner <niklas@bittner.tech>
Date: Sun, 25 Feb 2024 22:38:56 +0100
Subject: [PATCH] fix: arbitrary lfi on wish image

---
 src/classes/wishthis/Wish.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/classes/wishthis/Wish.php b/src/classes/wishthis/Wish.php
index 86c44dc9..3a284328 100644
--- a/src/classes/wishthis/Wish.php
+++ b/src/classes/wishthis/Wish.php
@@ -339,7 +339,7 @@ class Wish
                     <?php if (file_exists(ROOT . $this->image)) { ?>
                         <?= file_get_contents(ROOT . $this->image) ?>
                     <?php } else { ?>
-                        <?= file_get_contents($this->image) ?>
+                        <?= file_get_contents(ROOT . self::NO_IMAGE) ?>
                     <?php } ?>
                 <?php } else { ?>
                     <img class="preview" src="<?= $this->image ?>" loading="lazy" />