From c42bd28d172a9ae7439cc3868ebfda87e93f3490 Mon Sep 17 00:00:00 2001
From: Cesar G <prototech91@gmail.com>
Date: Thu, 12 Dec 2013 14:40:03 -0800
Subject: [ticket/12009] Prevent user from enabling invalid extension through
 direct URL

PHPBB3-12009
---
 phpBB/phpbb/extension/metadata_manager.php | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

(limited to 'phpBB/phpbb/extension')

diff --git a/phpBB/phpbb/extension/metadata_manager.php b/phpBB/phpbb/extension/metadata_manager.php
index d0323120d8..66cdb86513 100644
--- a/phpBB/phpbb/extension/metadata_manager.php
+++ b/phpBB/phpbb/extension/metadata_manager.php
@@ -266,8 +266,8 @@ class metadata_manager
 	 */
 	public function validate_enable()
 	{
-		// Check for phpBB, PHP versions
-		if (!$this->validate_require_phpbb() || !$this->validate_require_php())
+		// Check for valid directory & phpBB, PHP versions
+		if (!$this->validate_dir() || !$this->validate_require_phpbb() || !$this->validate_require_php())
 		{
 			return false;
 		}
@@ -275,6 +275,16 @@ class metadata_manager
 		return true;
 	}
 
+	/**
+	 * Validates the most basic directory structure to ensure it follows <vendor>/<ext> convention.
+	 *
+	 * @return boolean True when passes validation
+	 */
+	public function validate_dir()
+	{
+		return (substr_count($this->ext_name, '/') === 1 && $this->ext_name == $this->get_metadata('name'));
+	}
+
 
 	/**
 	 * Validates the contents of the phpbb requirement field
-- 
cgit v1.2.1