diff --git a/classes/modules/staticModule.php b/classes/modules/staticModule.php index 51f51ec23edabff535b0923e7724ced95753ae28..4ce161df9c0e3191b0b3a2b9e5eb9a66631b9406 100644 --- a/classes/modules/staticModule.php +++ b/classes/modules/staticModule.php @@ -30,8 +30,8 @@ class StaticModule extends abstractModule{ $imgdir = realpath($conf['static']['directory'] . "img"); $resourcepath = realpath($conf['static']['directory'].$file); - // static resources should be in static or img dir (img may be symlinked) - if (not(strpos($resourcepath, $staticdir)=== 0 or strpos($resourcepath, $imgdir)=== 0)) { + // static resources should be in static or img dir (img may be symlinked, check realpath of img as well) + if (strpos($resourcepath, $staticdir)!== 0 and strpos($resourcepath, $imgdir)!== 0) { HTTPStatus::send404($file); // send404 calls exit();// } $filenamearray =explode(".",$file);