Mirrors/PrivateBin
1
0
Fork 0
mirror of https://github.com/PrivateBin/PrivateBin.git synced 2026-07-17 16:39:40 +00:00
Code Issues Projects Releases Wiki Activity

use realpath and validate tpl directory contents

Browse source 
to ensure only php files inside the tpl dir can get used as templates
This commit is contained in:
El RIDO 2025-11-11 09:34:54 +01:00
parent dae5f7fd61
commit f2164353c3
No known key found for this signature in database
GPG key ID: 0F5C940A6BD81F92
2 changed files with 22 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
tst/ViewTest.php
View file

@ -141,4 +141,13 @@ class ViewTest extends TestCase
$this->expectExceptionCode(80);
$test->draw('123456789 does not exist!');
}
public function testInvalidTemplate()
{
$test = new View;
$this->expectException(Exception::class);
$this->expectExceptionCode(81);
$test->draw('../index');
}
}