Skip to content

Commit 4df23ad

Browse files
committed
+backup directory check, -closing PHP tag.
I added a backup directory check (as of now, you can download fake backups). I also removed the closing PHP tag that isn't needed.
1 parent 8503efa commit 4df23ad

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

web/download/backup/index.php

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,11 @@
55
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
66
$backup = $_GET['backup'];
77

8+
// Check if the backup exists
9+
if (!file_exists($backup)) {
10+
exit(0);
11+
}
12+
813
// Data
914
if ($_SESSION['user'] == 'admin') {
1015
header('Content-type: application/gzip');
@@ -19,5 +24,3 @@
1924
header("X-Accel-Redirect: /backup/" . $backup);
2025
}
2126
}
22-
23-
?>

0 commit comments

Comments
 (0)