From 77d1af501a4dd4aafb372baf57ecb871d26d5458 Mon Sep 17 00:00:00 2001 From: Dennis Eichhorn Date: Sun, 27 Dec 2015 21:32:54 +0100 Subject: [PATCH] Update security_guidelines.md --- security_guidelines.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/security_guidelines.md b/security_guidelines.md index 7cc568e..00193ef 100644 --- a/security_guidelines.md +++ b/security_guidelines.md @@ -99,14 +99,14 @@ path in order to make sure the path exists and for further validation. Example usage: ``` -if(($pathNew = realpath($path)) === false || strpos($pathNew, self::MODULE_PATH) === false) { +if(($pathNew = realpath($path)) === false || strpos($pathNew, ROOT_PATH . '/Modules/' . self::$module) === false) { throw new FilePathException($path); } ``` The example throws an exception if the path either doesn't exist or is trying -to access a path that doesn't contain the path defined in `self::MODULE_PATH`. -Another validation could be: +to access a path that doesn't contain the path defined in +`ROOT_PATH . '/Modules/' . self::$module`. Another validation could be: ``` if(($pathNew = realpath($path)) === false || !Validator::startsWith($pathNew, ROOT_PATH)) {