Re: PHP-Nuke <= 8.0 Cookie Manipulation (lang)

[Paul Laudanski]

[EMAIL PROTECTED] wrote:
Patch:

} elseif (isset($lang)) {
   if (eregi('[A-Za-z]', $lang)) {
      if (file_exists("language/lang-".$lang.".php")) {
               include_once("language/lang-".$lang.".php");
                $currentlang = $lang;
            }else {
                  include_once("language/lang-english.php");
                        $currentlang = "english";
		} 
	  }else {
           include_once("language/lang-english.php");
           $currentlang = "english";
          }
} else {

/////////////////////////////////////////////////////////////////////////////////////////////////
Best Regards
Aleksandar
Programmer and Web Developer
///////////////////////////////////////////////////////////////////////////////////////////////

  
Building on your patch you'd want to incorporate basename().  You never 
want to accept directory traversal attempts into variables.

Paul Laudanski, CastleCops
http://www.linkedin.com/pub/1/49a/17b
Submit Phish: www.castlecops.com/pirt
www.castlecops.com | de.castlecops.com | wiki.castlecops.com