fixed a security issue which in certain cases could result in directory traversal
diff --git a/system/core/Router.php b/system/core/Router.php
index b371d52..d911eb2 100644
--- a/system/core/Router.php
+++ b/system/core/Router.php
@@ -345,7 +345,7 @@
*/
function set_class($class)
{
- $this->class = $class;
+ $this->class = str_replace(array('/', '.'), '', $class);
}
// --------------------------------------------------------------------
@@ -404,7 +404,7 @@
*/
function set_directory($dir)
{
- $this->directory = trim($dir, '/').'/';
+ $this->directory = str_replace(array('/', '.'), '', $dir).'/';
}
// --------------------------------------------------------------------