PrivateCoffee/wishthis
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix: arbitrary lfi on wish image

Browse source
This commit is contained in:
Niklas Bittner 2024-02-25 22:38:56 +01:00 committed by Jay Trees
parent 212c4754ee
commit 2751bb2028
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/classes/wishthis/Wish.php
View file

@ -339,7 +339,7 @@ class Wish
<?php if (file_exists(ROOT . $this->image)) { ?> <?php if (file_exists(ROOT . $this->image)) { ?>
<?= file_get_contents(ROOT . $this->image) ?> <?= file_get_contents(ROOT . $this->image) ?>
<?php } else { ?> <?php } else { ?>
<?= file_get_contents($this->image) ?> <?= file_get_contents(ROOT . self::NO_IMAGE) ?>
<?php } ?> <?php } ?>
<?php } else { ?> <?php } else { ?>
<img class="preview" src="<?= $this->image ?>" loading="lazy" /> <img class="preview" src="<?= $this->image ?>" loading="lazy" />