diff --git a/lib/file-control-xhr.php b/lib/file-control-xhr.php index 82f1ed9..ed084d0 100644 --- a/lib/file-control-xhr.php +++ b/lib/file-control-xhr.php @@ -73,7 +73,7 @@ if (!$error) { // Die if the file requested isn't something we expect if( // On the banned file/dir list - ($_SESSION['bannedFiles'][$i] != "" && strpos($allFiles[$i],$_SESSION['bannedFiles'][$i])!==false) || + (str_replace("*","",$_SESSION['bannedFiles'][$i]) != "" && strpos($allFiles[$i],str_replace("*","",$_SESSION['bannedFiles'][$i]))!==false) || // A local folder that isn't the doc root or starts with the doc root ($_GET['action']!="getRemoteFile" && !isset($ftpSite) && rtrim($allFiles[$i],"/") !== rtrim($docRoot,"/") && diff --git a/lib/file-control.php b/lib/file-control.php index e296669..ba3e0dd 100644 --- a/lib/file-control.php +++ b/lib/file-control.php @@ -70,7 +70,7 @@ if ($_GET['action']=="load") { // Check this file isn't on the banned list at all $canOpen = true; for ($i=0;$i