diff --git a/php/delete.php b/php/delete.php index c730e26..921dac4 100644 --- a/php/delete.php +++ b/php/delete.php @@ -3,7 +3,9 @@ if(isset($_POST["op"]) && $_POST["op"] == "delete" && isset($_POST['name'])) { $fileName =$_POST['name']; - $fileName=str_replace("..",".",$fileName); //required. if somebody is trying parent folder files + while(strpos($fileName,"..")){ + $fileName=str_replace("..",".",$fileName); //required. if somebody is trying parent folder files + } $filePath = $output_dir. $fileName; if (file_exists($filePath)) { @@ -12,4 +14,4 @@ echo "Deleted File ".$fileName."
"; } -?> \ No newline at end of file +?>