ensure template cookie cannot be a path

2026-03-05 13:30:32 -05:00 · 2025-11-11 17:52:48 +01:00
parent fffa9fb4e9
commit 125f57c5b4
1 changed files with 5 additions and 2 deletions
--- a/lib/TemplateSwitcher.php
+++ b/lib/TemplateSwitcher.php
@@ -73,8 +73,11 @@ class TemplateSwitcher
     */
    public static function getTemplate(): string
    {
-        if (array_key_exists('template', $_COOKIE) && self::isTemplateAvailable($_COOKIE['template'])) {
-            return $_COOKIE['template'];
+        if (array_key_exists('template', $_COOKIE)) {
+            $template = basename($_COOKIE['template']);
+            if (self::isTemplateAvailable($template)) {
+                return $template;
+            }
        }
        return self::$_templateFallback;
    }