use detaintPath on modal to prevent including other files instead of real modals

2023-02-20 11:58:10 -05:00 · 2023-02-20 11:58:10 -05:00 · 119e4e6756
parent 4067151fd8
commit 119e4e6756
1 changed files with 3 additions and 4 deletions
--- a/web/ajax/modal.php
+++ b/web/ajax/modal.php
@ -1,11 +1,10 @@
 <?php
-
 if (empty($_REQUEST['modal'])) {
  ajaxError('Modal Name Not Provided');
  return;
 }

-$modal = validJsStr($_REQUEST['modal']);
+$modal = detaintPath($_REQUEST['modal']);
 $data = array();

 ZM\Debug("Including modals/$modal.php");