Skip to content

Check page name before any inclusion #193

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
coudot merged 3 commits into from
Dec 9, 2025
Merged

Check page name before any inclusion #193

coudot merged 3 commits into from
Dec 9, 2025

Conversation

@coudot
Copy link
Member

@coudot coudot commented Nov 28, 2025

Using open_basedir was not possible with Smarty:

[28-Nov-2025 16:23:51 UTC] PHP Warning:  is_file(): open_basedir restriction in effect. File(/usr/share/php/smarty4/libs/sysplugins/smarty_template_compiled.php) is not within the allowed path(s): (/usr/local/white-pages) in /usr/share/php/smarty4/libs/Autoloader.php on line 100

So I choose to only check the validity of the page name.

@coudot coudot linked an issue Nov 28, 2025 that may be closed by this pull request
Local file inclusion via "page" GET param #191
Closed
@coudot coudot added this to the 0.5 milestone Nov 28, 2025
@coudot coudot mentioned this pull request Nov 28, 2025
Closed
cestef
cestef reviewed Nov 28, 2025
View reviewed changes
@coudot coudot merged commit 4d7a491 into master Dec 9, 2025
1 check passed
@coudot coudot deleted the 191-local-file-inclusion-via-page-get-param branch December 9, 2025 08:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@cestef cestef cestef left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

security

Projects

None yet

Milestone

0.5

Development

Successfully merging this pull request may close these issues.

Local file inclusion via "page" GET param

3 participants

@coudot @cestef