Merge pull request #381 from getformwork/fix/backup-download-path-tra…

…versal Add basename to fix path traversal on backup download
getformwork · Oct 30, 2022 · dc1d6ca · dc1d6ca
2 parents 09b0138 + c5b7376
commit dc1d6ca
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/admin/src/Controllers/Backup.php b/admin/src/Controllers/Backup.php
@@ -37,7 +37,7 @@ public function make(): void
     public function download(RouteParams $params): void
     {
         $this->ensurePermission('backup.download');
-        $file = $this->option('backup.path') . base64_decode($params->get('backup'));
+        $file = $this->option('backup.path') . basename(base64_decode($params->get('backup')));
         try {
             if (FileSystem::isFile($file, false)) {
                 HTTPResponse::download($file);