From: Tim Düsterhus <duesterhus@woltlab.com>
Date: Thu, 27 Mar 2014 17:40:54 +0000 (+0100)
Subject: Disallow overwriting existing applications by using relative paths
X-Git-Tag: 2.1.0_Alpha_1~948
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=72eca8cdb13ad33d790ca177a10612f661c277e7;p=GitHub%2FWoltLab%2FWCF.git

Disallow overwriting existing applications by using relative paths

see https://www.woltlab.com/forum/index.php/Thread/222390-%C3%9Cberschreiben-von-Endanwendungen-m%C3%B6glich/
---

diff --git a/wcfsetup/install/files/lib/system/package/PackageInstallationDispatcher.class.php b/wcfsetup/install/files/lib/system/package/PackageInstallationDispatcher.class.php
index 62d8836580..826dc8ecc5 100644
--- a/wcfsetup/install/files/lib/system/package/PackageInstallationDispatcher.class.php
+++ b/wcfsetup/install/files/lib/system/package/PackageInstallationDispatcher.class.php
@@ -693,7 +693,8 @@ class PackageInstallationDispatcher {
 		else {
 			$document = PackageInstallationFormManager::getForm($this->queue, 'packageDir');
 			$document->handleRequest();
-			$packageDir = FileUtil::addTrailingSlash(FileUtil::unifyDirSeparator($document->getValue('packageDir')));
+			$packageDir = FileUtil::addTrailingSlash(FileUtil::getRealPath(FileUtil::unifyDirSeparator($document->getValue('packageDir'))));
+			if ($packageDir === '/') $packageDir = '';
 			
 			if ($packageDir !== null) {
 				// validate package dir