Forgot to check for windows-style path seperator in precaution against directory traversal abuse.

This commit is contained in:
Thilo Schulz 2006-06-01 00:23:46 +00:00
parent 503c0a22c6
commit 9af85d9378

View file

@ -1445,7 +1445,7 @@ void CL_NextDownload(void) {
s = localName + strlen(localName); // point at the nul byte
// Make sure the server cannot make us write to non-quake3 directories.
if(strstr(localName, "../"))
if(strstr(localName, "../") || strstr(localName, "..\\"))
{
Com_Error(ERR_DROP, "CL_NextDownload: Invalid download name %s", localName);
return;