diff --git a/src/Files.php b/src/Files.php index 23eee84d..b634c344 100644 --- a/src/Files.php +++ b/src/Files.php @@ -9,6 +9,8 @@ namespace Joomla\Input; +use Joomla\Filter\InputFilter; + /** * Joomla! Input Files Class * @@ -63,6 +65,15 @@ public function get($name, $default = null, $filter = 'cmd') ] ); + // Prevent returning an unsafe file unless specifically requested + if (strtoupper($filter) !== 'RAW') { + $isSafe = InputFilter::isSafeFile($results); + + if (!$isSafe) { + return $default; + } + } + return $results; }