commit 1ba5381a59770700b02f1f1023d2b2dca73c5e8d
author Matthias Andreas Benkard <code@mail.matthias.benkard.de> Tue Dec 27 17:32:58 2022 +0100
committer Matthias Andreas Benkard <code@mail.matthias.benkard.de> Tue Dec 27 17:32:58 2022 +0100
tree 528a81eb8aeda2c3aed62879608e1de4083760b5
parent d2755e91695519a72e9d9f0c9bae69c26c6fb11e

git subrepo commit mailcow/src/mailcow-dockerized

subrepo: subdir:   "mailcow/src/mailcow-dockerized"
  merged:   "308860af"
upstream: origin:   "https://github.com/mailcow/mailcow-dockerized.git"
  branch:   "master"
  commit:   "3f1a5af8"
git-subrepo: version:  "0.4.5"
  origin:   "???"
  commit:   "???"
Change-Id: I5d51c14b45db54fe706be40a591ddbfcea50d4b0

mailcow/src/mailcow-dockerized/data/web/resource.php

diff --git a/mailcow/src/mailcow-dockerized/data/web/resource.php b/mailcow/src/mailcow-dockerized/data/web/resource.php
index 96d41c1..1f35afa 100644
--- a/mailcow/src/mailcow-dockerized/data/web/resource.php
+++ b/mailcow/src/mailcow-dockerized/data/web/resource.php
@@ -1,6 +1,15 @@
 <?php
 
+if (!isset($_GET['file']) ) {
+    http_response_code(404);
+    exit;
+}
 $pathinfo = pathinfo($_GET['file']);
+
+if (!array_key_exists('extension', $pathinfo)) {
+    http_response_code(404);
+    exit;
+}
 $extension = strtolower($pathinfo['extension']);
 
 $filepath = '/tmp/' . $pathinfo['basename'];