From 3f99e02aac20ec7f8d7f1cfa3ec16f38b5ef2dd1 Mon Sep 17 00:00:00 2001
From: Matt Pass <matt@mattpass.com>
Date: Wed, 2 Oct 2019 08:59:50 +0100
Subject: [PATCH] Fixed checking of banned files

---
 lib/file-control-xhr.php | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/file-control-xhr.php b/lib/file-control-xhr.php
index d88696c..d5363d7 100644
--- a/lib/file-control-xhr.php
+++ b/lib/file-control-xhr.php
@@ -70,10 +70,18 @@ if (!$error) {
 		// Uncomment to alert and console.log the action and file, useful for debugging
 		// echo ";alert('".xssClean($_GET['action'],"html")." : ".$allFiles[$i]."');console.log('".xssClean($_GET['action'],"html")." : ".$allFiles[$i]."');";
 
+		$bannedFileFound = false;
+		for ($j=0; $j<count($_SESSION['bannedFiles']); $j++) {
+			$thisFile = str_replace("*","",$_SESSION['bannedFiles'][$j]);
+			if ($thisFile != "" && strpos($allFiles[$i],$thisFile)!==false) {
+				$bannedFileFound = true;
+			}
+		}
+
 		// Die if the file requested isn't something we expect
 		if(
 			// On the banned file/dir list
-			(str_replace("*","",$_SESSION['bannedFiles'][$i]) != "" && strpos($allFiles[$i],str_replace("*","",$_SESSION['bannedFiles'][$i]))!==false) ||
+			($bannedFileFound) ||
 			// A local folder that isn't the doc root or starts with the doc root
 			($_GET['action']!="getRemoteFile" && !isset($ftpSite) && 
 				rtrim($allFiles[$i],"/") !== rtrim($docRoot,"/") &&