Sanitize file in parse function

1 files changed, 6 insertions, 0 deletions

diff --git a/functions/template.php b/functions/template.php
index cb2431f..8f477c9 100644
--- a/functions/template.php
+++ b/functions/template.php
@@ -1034,11 +1034,17 @@ class Page {
 		}
 
 	function parse($file) {
+		global $template;
 		ob_start();
+		$file = str_replace("..","",$file);
+			if (strpos($file, "$template") > 0 || $file =='./functions/event.js'){
 		include($file);
 		$buffer = ob_get_contents();
 		ob_end_clean();
 		return $buffer;
+		}else{
+			die('breakin attempt');
+		}
 	}
 	
 	function replace_tags($tags = array()) {