SpigotMC-Mirrors/PlaceholderAPI
1
0
Fork 0
mirror of https://github.com/PlaceholderAPI/PlaceholderAPI synced 2024-11-18 00:46:55 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #946 from JulianVennen/block-load-path-traversal

Browse Source 
Prevent loading of extensions outside of the expansions folder using the register command
This commit is contained in:
Gabriel Dumitru 2023-04-04 17:28:00 +03:00 committed by GitHub
commit 744cf6d8c0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/main/java/me/clip/placeholderapi/commands/impl/local/CommandExpansionRegister.java
View File

@ -54,7 +54,7 @@ public final class CommandExpansionRegister extends PlaceholderCommand {
final LocalExpansionManager manager = plugin.getLocalExpansionManager();
final File file = new File(manager.getExpansionsFolder(), params.get(0));
if (!file.exists()) {
if (!file.exists() || !file.getParentFile().equals(manager.getExpansionsFolder())) {
Msg.msg(sender,
"&cThe file &f" + file.getName() + "&c doesn't exist!");
return;