WP Merge, page template validation

git-svn-id: http://svn.automattic.com/wordpress-mu/trunk@1294 7be80a69-a1ef-0310-a953-fb0f7c49ff36

2 files changed, 17 insertions, 1 deletions

diff --git a/wp-includes/functions.php b/wp-includes/functions.php
index b1b85bd..51445a1 100644
--- a/wp-includes/functions.php
+++ b/wp-includes/functions.php
@@ -1762,4 +1762,20 @@ function apache_mod_loaded($mod, $default = false) {
 	return $default;
 }
 
+function validate_file( $file, $allowed_files = '' ) {
+	if ( false !== strpos( $file, '..' ))
+		return 1;
+
+	if ( false !== strpos( $file, './' ))
+		return 1;
+
+	if (':' == substr( $file, 1, 1 ))
+		return 2;
+
+	if (!empty ( $allowed_files ) && (!in_array( $file, $allowed_files ) ) )
+		return 3;
+
+	return 0;
+}
+
 ?>
diff --git a/wp-includes/theme.php b/wp-includes/theme.php
index 984b4ee..2bff937 100644
--- a/wp-includes/theme.php
+++ b/wp-includes/theme.php
@@ -419,7 +419,7 @@ function get_page_template() {
 	if ( 'default' == $template )
 		$template = '';
 
-	if ( !empty($template) && file_exists(TEMPLATEPATH . "/$template") )
+	if ( !empty($template) && !validate_file($template) && file_exists(TEMPLATEPATH . "/$template") )
 		$template = TEMPLATEPATH . "/$template";
 	elseif ( file_exists(TEMPLATEPATH . "/page.php") )
 		$template = TEMPLATEPATH . "/page.php";