From 4fc4ee721ee559980c1caf9b8f5d2130f827095b Mon Sep 17 00:00:00 2001
From: gRoussac <gregory.roussac@prestashop.com>
Date: Thu, 26 Sep 2013 17:50:26 +0200
Subject: [PATCH] [*] BO : Adminimport, check csv download path

---
 controllers/admin/AdminImportController.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/controllers/admin/AdminImportController.php b/controllers/admin/AdminImportController.php
index 0f06fa577..95e0ab6bf 100644
--- a/controllers/admin/AdminImportController.php
+++ b/controllers/admin/AdminImportController.php
@@ -2802,6 +2802,8 @@ class AdminImportControllerCore extends AdminController
 		{
 			$filename = base64_decode($filename);
 			$file =  _PS_ADMIN_DIR_.'/import/'.basename($filename);
+			if (realpath(dirname($file)) != _PS_ADMIN_DIR_.'/import')
+				exit();
 			if (!empty($filename) && file_exists($file))
 			{
 				$bName = basename($filename);