From de52e7ee61a842d8fdf791f2a5b7c91b6c5cdb56 Mon Sep 17 00:00:00 2001
From: John Campbell <jcampbell1@gmail.com>
Date: Wed, 26 Apr 2017 11:43:50 -0400
Subject: [PATCH] quick fix to security issue

---
 index.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/index.php b/index.php
index 969e37e..7532d56 100644
--- a/index.php
+++ b/index.php
@@ -47,6 +47,9 @@ if($tmp === false)
 	err(404,'File or Directory Not Found');
 if(substr($tmp, 0,strlen($tmp_dir)) !== $tmp_dir)
 	err(403,"Forbidden");
+if(strpos($_REQUEST['file'], DIRECTORY_SEPARATOR) === 0) 
+	err(403,"Forbidden");
+
 
 if(!$_COOKIE['_sfm_xsrf'])
 	setcookie('_sfm_xsrf',bin2hex(openssl_random_pseudo_bytes(16)));