saadchellah

change to this in \wp-includes/functions.php

    // Normalize path for Windows servers

    $file = wp_normalize_path( $file );

    // Normalize all allowed file paths

    $allowed_files = array_map( 'wp_normalize_path', $allowed_files );

    // ../ on its own is not allowed:

    if ( '../' === $file ) {

        return 1;

    }

    // More than one occurrence of ../ is not allowed:

    if ( preg_match_all( '#\.\./#', $file, $matches, PREG_SET_ORDER ) && ( count( $matches ) > 1 ) ) {

        return 1;

    }

    // ../ which does not occur at the end of the path is not allowed:

    if ( str_contains( $file, '../' ) && '../' !== mb_substr( $file, -3, 3 ) ) {

        return 1;

    }

    // Files not in the allowed file list are not allowed:

    if ( ! empty( $allowed_files ) && ! in_array( $file, $allowed_files, true ) ) {

        return 3;

    }

    // Absolute Windows drive paths are not allowed:

    if ( ':' === substr( $file, 1, 1 ) ) {

        return 2;

    }

    return 0;

}

• This reply was modified 1 year, 11 months ago by saadchellah.