if outside either paths, send404

classes/modules/staticModule.php

@@ -30,8 +30,8 @@ class StaticModule extends abstractModule{
     $imgdir = realpath($conf['static']['directory'] . "img");
     $resourcepath = realpath($conf['static']['directory'].$file);
 
-    // static resources should be in static or img dir (img may be symlinked)
-    if (not(strpos($resourcepath, $staticdir)=== 0 or strpos($resourcepath, $imgdir)=== 0)) {
+    // static resources should be in static or img dir (img may be symlinked, check realpath of img as well)
+    if (strpos($resourcepath, $staticdir)!== 0 and strpos($resourcepath, $imgdir)!== 0) {
     	HTTPStatus::send404($file); // send404 calls exit();//
         }
         $filenamearray =explode(".",$file);