Replace \ with / in path to check

mattpass · mattpass · commit 343c07c23808 · 2015-04-27T16:54:42.000+01:00
diff --git a/lib/bug-files-check.php b/lib/bug-files-check.php
@@ -15,7 +15,7 @@
 	// Work out the real path for a file
 	$files[$i] = realpath($_SERVER['DOCUMENT_ROOT'].$files[$i]);
 	// If we can't find that file or it doesn't start with the doc root, it's an error
-	if (!file_exists($files[$i]) || strpos($files[$i],$_SERVER['DOCUMENT_ROOT']) !== 0) {
+	if (!file_exists($files[$i]) || strpos(str_replace("\\","/",$files[$i]),$_SERVER['DOCUMENT_ROOT']) !== 0) {
 		$result = "error";
 	} else {
 		$filesSizesSeen[$i] = filesize($files[$i]);
diff --git a/lib/download.php b/lib/download.php
@@ -5,7 +5,7 @@
 // Establish the real absolute path to the file
 $file = realpath($docRoot.$iceRoot.str_replace("|","/",strClean($_GET['file'])));
 // If it doesn't exist, or doesn't start with the $docRoot, stop here
-if (!file_exists($file) || strpos($file,$docRoot) !== 0) {
+if (!file_exists($file) || strpos(str_replace("\\","/",$file),$docRoot) !== 0) {
 	die("<script>alert('Sorry, that file doesn\'t appear to exist');</script>");
 }
 

Original file line number	Diff line number	Diff line change
`@@ -5,7 +5,7 @@`
`5`	`5`	`// Establish the real absolute path to the file`
`6`	`6`	`$file = realpath($docRoot.$iceRoot.str_replace("\|","/",strClean($_GET['file'])));`
`7`	`7`	`// If it doesn't exist, or doesn't start with the $docRoot, stop here`
`8`		`-if (!file_exists($file) \|\| strpos($file,$docRoot) !== 0) {`
	`8`	`+if (!file_exists($file) \|\| strpos(str_replace("\\","/",$file),$docRoot) !== 0) {`
`9`	`9`	`die("<script>alert('Sorry, that file doesn\'t appear to exist');</script>");`
`10`	`10`	`}`
`11`	`11`