fixed #3237

zikula · Dec 3, 2016 · 1a8220a · 1a8220a
1 parent df474a8
commit 1a8220a
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/CHANGELOG-1.3.md b/CHANGELOG-1.3.md
@@ -5,6 +5,7 @@ CHANGELOG - ZIKULA 1.3.11
 - Add filter parameter to Menutree in order to work better with Clip (#2597)
 - Fixed user block is not shown and not editable (#2891)
 - Fixed getPluralOffset to return numbers instead of boolean values (#3010)
+- Fixed possible jcss vulnerability in Windows environment (#3237)
 
 
 CHANGELOG - ZIKULA 1.3.10

diff --git a/src/jcss.php b/src/jcss.php
@@ -36,6 +36,7 @@
 }
 
 // clean $f
+$f = str_replace('\\', '', $f);
 $f = preg_replace('`/`', '', $f);
 
 // set full path to the file