From 80ec0b9b40dafd9b6329b5447b7e196a0d2ce4f0 Mon Sep 17 00:00:00 2001 From: Cameron Date: Sat, 27 Apr 2013 13:15:04 -0700 Subject: [PATCH] Prevent hash disclosure. --- e107_handlers/e_parse_class.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/e107_handlers/e_parse_class.php b/e107_handlers/e_parse_class.php index 88b34cc2b..2e3edefec 100644 --- a/e107_handlers/e_parse_class.php +++ b/e107_handlers/e_parse_class.php @@ -1839,6 +1839,11 @@ class e_parse extends e_parser { parse_str($options, $options); } + + if(strstr($url,e_MEDIA) || strstr($url,e_SYSTEM)) // prevent disclosure of 'hashed' path. + { + $raw = true; + } if($raw) $url = $this->createConstants($url, 'mix');