From 078068e2527747f5688997d5dc1293213de65bd1 Mon Sep 17 00:00:00 2001
From: Matt Pass <matt@mattpass.com>
Date: Wed, 23 Apr 2014 07:12:13 +0100
Subject: [PATCH] Don't allow directory traversal

---
 lib/download.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/download.php b/lib/download.php
index 0872d1c..c562250 100644
--- a/lib/download.php
+++ b/lib/download.php
@@ -2,7 +2,7 @@
 include("headers.php");
 include("settings.php");
 
-$file = $docRoot.$iceRoot.str_replace("|","/",$_GET['file']);
+$file = $docRoot.$iceRoot.str_replace("../","",str_replace("|","/",$_GET['file']));
 
 if (file_exists($file)) {
     header('Content-Description: File Transfer');