From e47b21ce80df1b164f6f805c1a012b2cdd2bebc6 Mon Sep 17 00:00:00 2001
From: Matt Pass <matt@mattpass.com>
Date: Thu, 18 Sep 2014 16:07:39 +0100
Subject: [PATCH] Don't check paths if we're uploading

---
 lib/file-control.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/file-control.php b/lib/file-control.php
index 87e0857..d8391c8 100644
--- a/lib/file-control.php
+++ b/lib/file-control.php
@@ -36,7 +36,7 @@ $allFiles = explode(";",$file);
 for ($i=0; $i<count($allFiles); $i++) {
 	// Die if the file requested isn't something we expect
 	if(
-        	($_GET['action']!="getRemoteFile" && strpos(realpath($allFiles[$i]),realpath($docRoot)) !== 0) ||
+        	($_GET['action']!="getRemoteFile" && $_GET['action']!="upload" && strpos(realpath($allFiles[$i]),realpath($docRoot)) !== 0) ||
 	        ($_GET['action']=="getRemoteFile" && strpos($allFiles[$i],"http") !== 0)
         	) {
 	        die("alert('Sorry - problem with file/folder requested');window.history.back();</script>");