|
27 | 27 |
|
28 | 28 | $cache = true; |
29 | 29 | $pullfromcache = false; |
| 30 | + $theme = $_GET['theme']; |
30 | 31 | $cachedir = dirname(__FILE__) . '/cache'; |
31 | | - $cssdir = dirname(__FILE__) . '/css'; |
| 32 | + $cssdir = dirname(__FILE__) . '/themes/' . $theme; |
32 | 33 | $jsdir = dirname(__FILE__) . '/js'; |
33 | 34 |
|
34 | 35 | // Determine the directory and type we should use |
|
52 | 53 | // Determine last modification date of the files |
53 | 54 | $lastmodified = 0; |
54 | 55 | while (list(,$element) = each($elements)) { |
55 | | - $path = realpath($base . '/' . $element); |
| 56 | + $thisbase = $base; |
| 57 | + $thiselement = $element; |
| 58 | + if( strpos($thiselement, "../") === 0 ){ |
| 59 | + $thiselement = str_replace("../","",$thiselement); |
| 60 | + $thisbase = explode("/", $thisbase); |
| 61 | + array_pop($thisbase); |
| 62 | + $thisbase = implode("/", $thisbase); |
| 63 | + } |
| 64 | + $path = realpath($thisbase . '/' . $thiselement); |
| 65 | + //echo $path; |
56 | 66 |
|
57 | 67 | if (($type == 'javascript' && substr($path, -3) != '.js') || |
58 | 68 | ($type == 'css' && substr($path, -4) != '.css')) { |
59 | 69 | header ("HTTP/1.0 403 Forbidden"); |
60 | 70 | exit; |
61 | 71 | } |
62 | 72 |
|
63 | | - if (substr($path, 0, strlen($base)) != $base || !file_exists($path)) { |
| 73 | + if (substr($path, 0, strlen($thisbase)) != $thisbase || !file_exists($path)) { |
64 | 74 | header ("HTTP/1.0 404 Not Found"); |
65 | 75 | exit; |
66 | 76 | } |
|
0 commit comments