From 6746f0ce03f96fec8bac41f596e62b94d678bf89 Mon Sep 17 00:00:00 2001 From: Nikita Sinelnikov Date: Mon, 10 Oct 2022 15:29:30 +0300 Subject: [PATCH] - fixed directory checking for localhosts; --- includes/core/class-shortcodes.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/includes/core/class-shortcodes.php b/includes/core/class-shortcodes.php index fdc5ec7a..cd7fa823 100644 --- a/includes/core/class-shortcodes.php +++ b/includes/core/class-shortcodes.php @@ -285,8 +285,8 @@ if ( ! class_exists( 'um\core\Shortcodes' ) ) { if ( file_exists( $file ) ) { // Avoid Directory Traversal vulnerability by the checking the realpath. // Templates can be situated only in the get_stylesheet_directory() or plugindir templates. - $real_file = realpath( $file ); - if ( 0 === strpos( $real_file, um_path . "templates" . DIRECTORY_SEPARATOR ) || 0 === strpos( $real_file, get_stylesheet_directory() . DIRECTORY_SEPARATOR . 'ultimate-member' . DIRECTORY_SEPARATOR . 'templates' . DIRECTORY_SEPARATOR ) ) { + $real_file = wp_normalize_path( realpath( $file ) ); + if ( 0 === strpos( $real_file, wp_normalize_path( um_path . "templates" . DIRECTORY_SEPARATOR ) ) || 0 === strpos( $real_file, wp_normalize_path( get_stylesheet_directory() . DIRECTORY_SEPARATOR . 'ultimate-member' . DIRECTORY_SEPARATOR . 'templates' . DIRECTORY_SEPARATOR ) ) ) { include $file; } }