Prevent loading of extensions outside of the expansions folder using the register command

This commit is contained in:
Julian 2023-03-30 12:47:23 +02:00
parent e862abe0b4
commit b4e60b7db5
No known key found for this signature in database
GPG Key ID: A0CA42F79DA926B1

View File

@ -54,7 +54,7 @@ public final class CommandExpansionRegister extends PlaceholderCommand {
final LocalExpansionManager manager = plugin.getLocalExpansionManager();
final File file = new File(manager.getExpansionsFolder(), params.get(0));
if (!file.exists()) {
if (!file.exists() || !file.getParentFile().equals(manager.getExpansionsFolder())) {
Msg.msg(sender,
"&cThe file &f" + file.getName() + "&c doesn't exist!");
return;