fixed #3237

zikula · Dec 3, 2016 · 3ab9614 · 3ab9614
1 parent c662205
commit 3ab9614
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/CHANGELOG-1.4.md b/CHANGELOG-1.4.md
@@ -31,6 +31,7 @@ CHANGELOG - ZIKULA 1.4.x
     - Fixed many issues with translation in the Core installer and upgrader (#2919, #3192).
     - Fixed issue with using permissions to hide blocks (#3200).
     - Refactored PhpParser usage in ZikulaPhpFileExtractor to namespaces (#3183).
+    - Fixed possible jcss vulnerability in Windows environment (#3237).
 
  - Features:
     - Lost password functionality has been simplified to work without an additional (confusing) confirmation step (#1781, #3178).

diff --git a/src/jcss.php b/src/jcss.php
@@ -33,6 +33,7 @@
 }
 
 // clean $f
+$f = str_replace('\\', '', $f);
 $f = preg_replace('`/`', '', $f);
 
 // set full path to the file