- Issue created by @willempje2
I had unpublished this not realizing it is the public post of an originally private issue. I've added a note about that to the issue summary.
- πΊπΈUnited States damienmckenna NH, USA
Adding the appropriate tag.
- First commit to issue fork.
- πΊπΈUnited States jrockowitz Brooklyn, NY
I think the below code should do the trick.
// Sanitize $file_name to remove directory traversing. $file_name = str_replace(['..', '/', '\\'], '', $query['filename']); $file_path = $this->submissionExporter->getFileTempDirectory() . '/' . $file_name;
- π³π±Netherlands willempje2
Tested, and this fix works for me (in a clean setup).
- π¨π¦Canada Liam Morland Ontario, CA π¨π¦
Please make a merge request.