From 113e045f26215832cd2226a26d55d159aa3facf7 Mon Sep 17 00:00:00 2001
From: Matt Pass <matt@mattpass.com>
Date: Wed, 17 Sep 2014 13:35:00 +0100
Subject: [PATCH] realpath file, result in error if !exist / !docroot

---
 lib/bug-files-check.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/bug-files-check.php b/lib/bug-files-check.php
index ff2a001..af70f31 100644
--- a/lib/bug-files-check.php
+++ b/lib/bug-files-check.php
@@ -12,8 +12,10 @@ $maxLines	= $_GET['maxLines'];
 $result = "ok";
 
 for ($i=0; $i<count($files); $i++) {
-	$files[$i] = $_SERVER['DOCUMENT_ROOT'].$files[$i];
-	if (!file_exists($files[$i])) {
+	// Work out the real path for a file
+	$files[$i] = realpath($_SERVER['DOCUMENT_ROOT'].$files[$i]);
+	// If we can't find that file or it doesn't start with the doc root, it's an error
+	if (!file_exists($files[$i]) || strpos($files[$i],$_SERVER['DOCUMENT_ROOT']) !== 0) {
 		$result = "error";
 	} else {
 		$filesSizesSeen[$i] = filesize($files[$i]);