DiskCache: more strict checking for input filenames, getUrl() is no longer static

1 files changed, 4 insertions, 0 deletions

diff --git a/include/functions.php b/include/functions.php
index 5a66e53b9..3f80ba5ba 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -594,6 +594,10 @@
 		}
 	}
 
+	function clean_filename($filename) {
+		return basename(preg_replace("/\.\.|[\/\\\]/", "", $filename));
+	}
+
 	function make_password($length = 12) {
 		$password = "";
 		$possible = "0123456789abcdfghjkmnpqrstvwxyzABCDFGHJKMNPQRSTVWXYZ*%+^";