diff options
Diffstat (limited to 'phpBB/phpbb/viewonline_helper.php')
| -rw-r--r-- | phpBB/phpbb/viewonline_helper.php | 19 |
1 files changed, 18 insertions, 1 deletions
diff --git a/phpBB/phpbb/viewonline_helper.php b/phpBB/phpbb/viewonline_helper.php index 3fc33119a3..b722f9d911 100644 --- a/phpBB/phpbb/viewonline_helper.php +++ b/phpBB/phpbb/viewonline_helper.php @@ -18,6 +18,17 @@ namespace phpbb; */ class viewonline_helper { + /** @var \phpbb\filesystem */ + protected $filesystem; + + /** + * @param \phpbb\filesystem $filesystem + */ + public function __construct(\phpbb\filesystem $filesystem) + { + $this->filesystem = $filesystem; + } + /** * Get user page * @@ -26,7 +37,13 @@ class viewonline_helper */ public function get_user_page($session_page) { - preg_match('#^([./\\]*+[a-z0-9/_-]+)#i', $session_page, $on_page); + $session_page = $this->filesystem->clean_path($session_page); + if (strpos($session_page, './') === 0) + { + $session_page = substr($session_page, 2); + } + + preg_match('#^((\.\./)*([a-z0-9/_-]+))#i', $session_page, $on_page); if (empty($on_page)) { $on_page[1] = ''; |