From cddd7eaab0e78e13059fd2a3e1b29f7391bea30c Mon Sep 17 00:00:00 2001
From: minghongg <64783310+minghongg@users.noreply.github.com>
Date: Wed, 25 Jan 2023 13:16:20 +0700
Subject: [PATCH] Deploy path traversal fix (#953)

Co-authored-by: root <root@chevaliers.lan>
---
 tinyfilemanager.php | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tinyfilemanager.php b/tinyfilemanager.php
index 9a41e33..5b57b7b 100644
--- a/tinyfilemanager.php
+++ b/tinyfilemanager.php
@@ -1065,6 +1065,15 @@ if (isset($_POST['group'], $_POST['token']) && (isset($_POST['zip']) || isset($_
     }
 
     $files = $_POST['file'];
+    $sanitized_files = array();
+
+    // clean path
+    foreach($files as $file){
+        array_push($sanitized_files, fm_clean_path($file));
+    }
+    
+    $files = $sanitized_files;
+    
     if (!empty($files)) {
         chdir($path);