Be more strict with $_GET[type] filtering before inclusion

1 files changed, 1 insertions, 1 deletions

diff --git a/index.php b/index.php
index 7b7fbed..3a2c1e4 100755
--- a/index.php
+++ b/index.php
@@ -36,7 +36,7 @@ if (isset($_GET['type']) && $_GET['type'] == 'atom10') {
 //Go display
 if (!isset($_GET['type']) ||
     !is_file(__DIR__.'/custom/views/'.$_GET['type'].'/index.tpl.php') ||
-    strpos($_GET['type'], DIRECTORY_SEPARATOR)){
+    strpos($_GET['type'], DIRECTORY_SEPARATOR) || strpos($GET['type'], '..')){
     $_GET['type'] = 'default';
 }