purify user-supplied filenames in some cases. Probably not needed but it's the right thing to do.

2017-10-09 15:13:25 -07:00
parent 23812e5b48
commit 623dfa1384
3 changed files with 11 additions and 2 deletions
--- a/include/text.php
+++ b/include/text.php
@@ -3156,3 +3156,9 @@ function ellipsify($s,$maxlen) {

 	return mb_substr($s,0,$maxlen / 2) . '...' . mb_substr($s,mb_strlen($s) - ($maxlen / 2));
 }
+
+function purify_filename($s) {
+	if(($s[0] === '.') || strpos($s,'/') !== false)
+		return '';
+	return $s;
+}