From 1e575c3a7f1710480a2bb1bd97e69e6a402b63be Mon Sep 17 00:00:00 2001
From: Tristan Schneider <tristanschneider2000@gmail.com>
Date: Sun, 13 Dec 2020 21:46:05 +0100
Subject: [PATCH] archive file access restricted to data directory

---
 archiv.php | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/archiv.php b/archiv.php
index 9bf7ea3..003ab0c 100644
--- a/archiv.php
+++ b/archiv.php
@@ -7,11 +7,15 @@
 <body>
 	<h1>One Word Each Archiv</h1>
 	<p><a href="./">Startseite</a></p>
-	<p class="sentences">
 	<?php
 	$filename = $_REQUEST["file"];
-	
+	if (strcmp(pathinfo($filename)["dirname"], ".") != 0) {
+		die("nur das echte Archiv ist hier erreichbar");
+	}
 	$content = file_get_contents("./data/".$filename) or die("ungültiger Dateiname");
+	?>
+	<p class="sentences">
+	<?php
 	print($content);
 	?>
 	</p>
