From f5705393eef5a0b98783c32ce936a54100e8bbd3 Mon Sep 17 00:00:00 2001
From: Matt Pass <matt@mattpass.com>
Date: Thu, 14 Apr 2016 08:25:42 +0100
Subject: [PATCH] Check if requested file is on banned list first

---
 lib/file-control.php | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/file-control.php b/lib/file-control.php
index f1fcd37..e296669 100644
--- a/lib/file-control.php
+++ b/lib/file-control.php
@@ -67,7 +67,15 @@ for ($i=0; $i<count($allFiles); $i++) {
 if ($_GET['action']=="load") {
 	echo 'action="load";';
 	$lineNumber = max(isset($_REQUEST['lineNumber'])?intval($_REQUEST['lineNumber']):1, 1);
-	if (isset($ftpSite) || file_exists($file)) {
+	// Check this file isn't on the banned list at all
+	$canOpen = true;
+	for ($i=0;$i<count($_SESSION['bannedFiles']);$i++) {
+		if($_SESSION['bannedFiles'][$i] != "" && strpos($file,$_SESSION['bannedFiles'][$i])!==false) {$canOpen = false;}
+	}
+
+	if (!$canOpen) {
+		echo 'fileType="nothing"; top.ICEcoder.message(\''.$t['Sorry, could not...'].' '.$fileLoc."/".$fileName.'\');';
+	} elseif (isset($ftpSite) || file_exists($file)) {
 		$finfo = "text";
 		// Determine what to do based on mime type
 		if (!isset($ftpSite) && function_exists('finfo_open')) {