From 5f82811ab35bbd5fac0d5a671c874398071ac55d Mon Sep 17 00:00:00 2001
From: Dan Q <github@danq.me>
Date: Thu, 12 Aug 2021 09:04:14 +0100
Subject: [PATCH] Add getDirForEmail to perform realPath filtering in core

---
 web/inc/core.php | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/web/inc/core.php b/web/inc/core.php
index e6593ea..2e4ba23 100644
--- a/web/inc/core.php
+++ b/web/inc/core.php
@@ -1,5 +1,10 @@
 <?php
 
+function getDirForEmail($email)
+{
+    return realpath(ROOT.DS.'..'.DS.'data'.DS.$email);
+}
+
 function startsWith($haystack, $needle)
 {
      $length = strlen($needle);
@@ -18,22 +23,22 @@ function endsWith($haystack, $needle)
 
 function getEmail($email,$id)
 {
-    return json_decode(file_get_contents(ROOT.DS.'..'.DS.'data'.DS.$email.DS.$id.'.json'),true);
+    return json_decode(file_get_contents(getDirForEmail($email).DS.$id.'.json'),true);
 }
 
 function emailIDExists($email,$id)
 {
-    return file_exists(ROOT.DS.'..'.DS.'data'.DS.$email.DS.$id.'.json');
+    return file_exists(getDirForEmail($email).DS.$id.'.json');
 }
 
 function getEmailsOfEmail($email)
 {
     $o = false;
-    if ($handle = opendir(ROOT.DS.'..'.DS.'data'.DS.$email)) {
+    if ($handle = opendir(getDirForEmail($email))) {
         while (false !== ($entry = readdir($handle))) {
             if (endsWith($entry,'.json')) {
                 $time = substr($entry,0,-5);
-                $json = json_decode(file_get_contents(ROOT.DS.'..'.DS.'data'.DS.$email.DS.$entry),true);
+                $json = json_decode(file_get_contents(getDirForEmail($email).DS.$entry),true);
                 $o[$time] = array('from'=>$json['parsed']['from'],'subject'=>$json['parsed']['subject']);
             }
         }
@@ -66,4 +71,4 @@ function loadSettings()
     if(file_exists(ROOT.DS.'..'.DS.'config.ini'))
         return parse_ini_file(ROOT.DS.'..'.DS.'config.ini');
     return false;
-}
\ No newline at end of file
+}