From c3d14e1fa54c7dade7b1b7955575e2991396d7ef Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <noreply@fakecake.org>
Date: Mon, 14 Sep 2020 19:46:52 +0300
Subject: - fix multiple vulnerabilities in af_proxy_http - fix vulnerability
 in rewrite_relative_url() which prevented some URLs from being properly
 absolutized - fetch_file_contents: validate all URLs before requesting them -
 validate URLs: explicitly whitelist http and https scheme, forbid everything
 else - DiskCache/cached_url: only serve whitelisted content types (images,
 video) - simplify filename/URL handling code, remove and consolidate some
 less-used functions

---
 classes/rpc.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'classes/rpc.php')

diff --git a/classes/rpc.php b/classes/rpc.php
index 208551075..7f809f29b 100755
--- a/classes/rpc.php
+++ b/classes/rpc.php
@@ -572,7 +572,7 @@ class RPC extends Handler_Protected {
 
 	function log() {
 		$msg = clean($_REQUEST['msg']);
-		$file = clean_filename($_REQUEST['file']);
+		$file = basename(clean($_REQUEST['file']));
 		$line = (int) clean($_REQUEST['line']);
 		$context = clean($_REQUEST['context']);
 
-- 
cgit v1.2.3