devs/foxbox
1
0
Fork 0
forked from len0rd/rockbox
Code Pull requests Activity

[Bugix] %ft has access to the root of the drive using /

Browse source 
path_append treats a path starting with / as absolute
allowing escape by themes

Change-Id: I8e5fb55f01cacd5ec0fc5538d92dfcfbdceb6892
This commit is contained in:
William Wilgus 2024-12-20 22:59:03 -05:00
parent 774357e722
commit 9c477e84ff
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apps/gui/skin_engine/skin_parser.c
View file

@ -1357,6 +1357,10 @@ static int parse_filetext(struct skin_element *element,
__func__, filename, element->params_count);
return WPS_ERROR_INVALID_PARAM;
}
while(*filename == PATH_SEPCH) /* no absolute paths! */
filename++;
path_append(buf, ROCKBOX_DIR, filename, sizeof(buf));
DEBUGF("%s %s[%d]\n", __func__, buf, line);