[*] BO : Adminimport, check csv download path

2013-09-26 17:50:26 +02:00
parent d3ad12e536
commit 4fc4ee721e
1 changed files with 2 additions and 0 deletions
@@ -2802,6 +2802,8 @@ class AdminImportControllerCore extends AdminController
 		{
 			$filename = base64_decode($filename);
 			$file =  _PS_ADMIN_DIR_.'/import/'.basename($filename);
+			if (realpath(dirname($file)) != _PS_ADMIN_DIR_.'/import')
+				exit();
 			if (!empty($filename) && file_exists($file))
 			{
 				$bName = basename($filename);