Simplify file name validation

We don't want to expose possible hidden files as well (starting with .
on unix).

1 files changed, 3 insertions, 5 deletions

diff --git a/js/get_scripts.js.php b/js/get_scripts.js.php
index 72b3b44de8..fdeddf4c3b 100644
--- a/js/get_scripts.js.php
+++ b/js/get_scripts.js.php
@@ -24,11 +24,9 @@ if (! empty($_GET['scripts']) && is_array($_GET['scripts'])) {
 
         $path = explode("/", $script);
         foreach ($path as $index => $filename) {
-            if (! preg_match("@^\.+$@", $filename)
-                && preg_match("@^[\w\.-]+$@", $filename)
-            ) {
-                // Disallow "." and ".." alone
-                // Allow alphanumeric, "." and "-" chars only
+            // Allow alphanumeric, "." and "-" chars only, no files starting
+            // with .
+            if (preg_match("@^[\w][\w\.-]+$@", $filename)) {
                 $script_name .= DIRECTORY_SEPARATOR . $filename;
             }
         }