The path the user wants to access must now BEGIN with the root directory. The

old check made it possible to access a directory structure outside the root
directory similar to the root directory.

diff --git a/modules/Tool.pm b/modules/Tool.pm
index 2d044e0de257baad669c5789ac9704083e367a92..c3548b0a14ef9b1827c7db59b23b5c04b9a11bbb 100644 (file)
--- a/modules/Tool.pm
+++ b/modules/Tool.pm
@@ -69,7 +69,7 @@ sub check_path($$)
 
  # Check if the path is above the root directory
 
- return if(index($path,$root) == -1);
+ return if(index($path,$root) != 0);
  return if($first eq $root && $last =~ m!^(/|\\)?\.\.(/|\\)?$!);
 
  # Create short path name