From 51e76f4109bad5893f70040b7029926a5a6be370 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michaelrsweet@users.noreply.github.com>
Date: Mon, 20 Oct 2008 22:47:29 +0000
Subject: [PATCH] Useless XSS fix.

---
 www/software.php | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/www/software.php b/www/software.php
index 577242b..8c3ebd8 100644
--- a/www/software.php
+++ b/www/software.php
@@ -23,11 +23,18 @@ fclose($fp);
 
 // Get form data, if any...
 if (array_key_exists("FILE", $_GET))
+{
   $file = $_GET["FILE"];
+
+  if (strpos($file, "../") !== FALSE ||
+      !file_exists("/home/ftp.easysw.com/pub/$file"))
+    $file = "";
+}
 else
   $file = "";
 
-if (array_key_exists("SITE", $_GET))
+if (array_key_exists("SITE", $_GET) &&
+    array_key_exists($_GET["SITE"], $PROJECT_SITELIST))
 {
   $site = $_GET["SITE"];
   setcookie("SITE", $site, time() + 90 * 86400, "/");