• Max Kellermann's avatar
    PlaylistFile: disallow backslash in playlist names on Windows · eaecbcaf
    Max Kellermann authored
    The function spl_valid_name() should verify playlist names and prevent
    path traversal, but it failed to do so on Windows, because it forgot
    to check for backslashes.
    
    This buggy piece of code was already present when stored playlists
    were initially implemented in 2006 by commit 08003904, and
    even during the many rounds of code refactoring, nobody ever bothered
    to verify it.  D'oh!
    
    (Thanks, Paul Arzelier)
    eaecbcaf
To find the state of this project's repository at the time of any of these versions, check out the tags.
NEWS 88.9 KB