path traversal exploit (this is what you get for using free software)

2025-03-02 21:58:18 -05:00 · 2025-03-02 21:58:18 -05:00 · b2203804c7
parent 36b0c570aa
commit b2203804c7
1 changed files with 6 additions and 1 deletions
--- a/favicon.php
+++ b/favicon.php
@ -15,7 +15,12 @@ class favicon{
 		
 		header("Content-Type: image/png");
 		
-		if(substr_count($url, "/") !== 2){
+		if(
+			preg_match(
+				'/^https?:\/\/[A-Za-z0-9.-]+$/',
+				$url
+			) === 0
+		){
 			
 			header("X-Error: Only provide the protocol and domain");
 			$this->defaulticon();