| Index: trunk/phase3/img_auth.php |
| — | — | @@ -43,11 +43,12 @@ |
| 44 | 44 | if( !$path ) { |
| 45 | 45 | wfForbidden( 'img-auth-accessdenied', 'img-auth-nopathinfo' ); |
| 46 | 46 | } |
| | 47 | + $path = "/$path"; |
| 47 | 48 | } else { |
| 48 | 49 | $path = $_SERVER['PATH_INFO']; |
| 49 | 50 | } |
| 50 | 51 | |
| 51 | | -$filename = realpath( $wgUploadDirectory . '/' . $path ); |
| | 52 | +$filename = realpath( $wgUploadDirectory . $path ); |
| 52 | 53 | $realUpload = realpath( $wgUploadDirectory ); |
| 53 | 54 | |
| 54 | 55 | // Basic directory traversal check |