News for hackers. Stuff that matters.

A comment on Interactive Javascript Terminal as a personal website. Parent comment

Re:Interactive Javascript Terminal as a personal website by eneko on Friday November 05, 2010 @12:32AM (#1872027)
Nice. The code was already checking for '..' on the path, but the condition was erroneous. Fixed now.
[ Parent | on HN ]
Re:Interactive Javascript Terminal as a personal website by toolate on Friday November 05, 2010 @03:01AM (#1872313)
You might be better off getting the canonical path and then checking against a whitelist. E.g. `strpos(realpath($command_path), '/var/www/html/') === 0`.
[ Parent | on HN ]