Fix two more gaping holes letting people examine whole filesystem

1 files changed, 7 insertions, 1 deletions

diff --git a/html/htmlshow.php b/html/htmlshow.php
index d9cb8b46..915aac6f 100644
--- a/html/htmlshow.php
+++ b/html/htmlshow.php
@@ -1,5 +1,11 @@
 <?php
   require('functions.php3');
-  hack_html($file,$title);
+  if (substr($file,0,1)=="." or 
+      substr($file,0,1)=="/" or
+      substr($file,0,1)=="~") {
+     print "Sorry, can't show you that file!\n"; 
+  } else {
+     hack_html($file,$title);
+  }
   footer(); 
 ?>