* Confine index.php external-link content includes
render_external_links() built the include path as
include/content/<contentfile> and required it after only a file_exists()
check. contentfile comes from the external_links table, so a '../' value
included an arbitrary local file. Resolve and confine the path to
include/content the way link.php already does, and html_escape the
contentfile in the iframe src and error message.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Escape only the filename in the not-found message and guard the test offsets
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
