From 035a477c4f30180edecead29e8bcda34a0725881 Mon Sep 17 00:00:00 2001
From: piernov <piernov@piernov.org>
Date: Mon, 2 May 2016 19:58:11 +0200
Subject: Better when the user isn't allowed of deleting arbitrary files…
 Thanks PHP for not highligthing the problem and not providing simple
 solution…
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 inc/savegame.inc | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/inc/savegame.inc b/inc/savegame.inc
index 2f8c70a..0dfb1c8 100644
--- a/inc/savegame.inc
+++ b/inc/savegame.inc
@@ -73,8 +73,9 @@ function parseSave($xml, &$table) { // Passing $table by reference
 
 function deleteSave() {
 	if(empty($_POST["filename"])) return;
-	$filename = $_POST["filename"];
-	if(unlink(SAVEDIR + "/" + $filename)) sendError("gamesave_delete_failed");
+	$path = SAVEDIR . "/" . basename($_POST["filename"]); // remove any leading directory
+	if(file_exists($path) && unlink($path))
+		sendError("gamesave_delete_failed");
 	else sendInfo("gamesave_delete_success");
 }
 
-- 
cgit v1.2.3-54-g00ecf