Ignore URL arguments when checking directory

2019-01-01 16:07:58 -07:00 · 2019-01-01 16:07:58 -07:00 · 4532d43aeb
commit 4532d43aeb
parent 7f931b77f7
1 changed files with 1 additions and 1 deletions
--- a/index.php
+++ b/index.php
@ -1191,7 +1191,7 @@ $EXT2MIME = [
 	"ice" => "x-conference/x-cooltalk",
 ];

-$path = $_SERVER['REQUEST_URI'];
+$path = explode('?', $_SERVER['REQUEST_URI'], 2)[0];
 $dir = realpath(__DIR__ . $path);
 if (strpos($dir, $ROOTPATH) !== 0) {
 	die("Access denied.");