[web-doc] master: allowlist for tutorial filename characters

Author: Peter Cowburn (salathe)
Date: 2021-07-27T14:34:47+01:00

Commit: https://github.com/php/web-doc/commit/e0d5dd0a6fb1b13b6f3bada396efc0cd37f947a8
Raw diff: https://github.com/php/web-doc/commit/e0d5dd0a6fb1b13b6f3bada396efc0cd37f947a8.diff

allowlist for tutorial filename characters

Changed paths:
  M  www/tutorial.php


Diff:

diff --git a/www/tutorial.php b/www/tutorial.php
index 776ea6c..0b17685 100644
--- a/www/tutorial.php
+++ b/www/tutorial.php
@@ -4,8 +4,8 @@
 
 $parsedown = new Parsedown();
 $chapter = isset($_GET['chapter']) ? $_GET['chapter'] : 'intro';
-$path = '../tutorial/'.str_replace('..', '', $chapter).'.md';
-// Very simple check against local file inclusion, maybe it could be done better way?
+$chapter = preg_replace("/[^a-z0-9-]/", "", $chapter);
+$path = '../tutorial/' . $chapter . '.md';
 
 if (file_exists($path)) {
     $content = file_get_contents($path);