From e3e236da72f9bb8985fcecc25758c98559f76179 Mon Sep 17 00:00:00 2001
From: Joas Schilling <nickvergessen@gmx.de>
Date: Tue, 8 Jul 2014 17:53:32 +0200
Subject: [ticket/12834] Correctly match directories in session page

Also clean path before working with it

PHPBB3-12834
---
 phpBB/config/services.yml         |  2 ++
 phpBB/phpbb/viewonline_helper.php | 19 ++++++++++++++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)

(limited to 'phpBB')

diff --git a/phpBB/config/services.yml b/phpBB/config/services.yml
index 735a49c99b..0862650011 100644
--- a/phpBB/config/services.yml
+++ b/phpBB/config/services.yml
@@ -362,3 +362,5 @@ services:
 
     viewonline_helper:
         class: phpbb\viewonline_helper
+        arguments:
+            - @filesystem
diff --git a/phpBB/phpbb/viewonline_helper.php b/phpBB/phpbb/viewonline_helper.php
index 3fc33119a3..b722f9d911 100644
--- a/phpBB/phpbb/viewonline_helper.php
+++ b/phpBB/phpbb/viewonline_helper.php
@@ -18,6 +18,17 @@ namespace phpbb;
 */
 class viewonline_helper
 {
+	/** @var \phpbb\filesystem */
+	protected $filesystem;
+
+	/**
+	* @param \phpbb\filesystem $filesystem
+	*/
+	public function __construct(\phpbb\filesystem $filesystem)
+	{
+		$this->filesystem = $filesystem;
+	}
+
 	/**
 	* Get user page
 	*
@@ -26,7 +37,13 @@ class viewonline_helper
 	*/
 	public function get_user_page($session_page)
 	{
-		preg_match('#^([./\\]*+[a-z0-9/_-]+)#i', $session_page, $on_page);
+		$session_page = $this->filesystem->clean_path($session_page);
+		if (strpos($session_page, './') === 0)
+		{
+			$session_page = substr($session_page, 2);
+		}
+
+		preg_match('#^((\.\./)*([a-z0-9/_-]+))#i', $session_page, $on_page);
 		if (empty($on_page))
 		{
 			$on_page[1] = '';
-- 
cgit v1.2.1