From 43f35352aa2a40892a1369a15062145bdc4bcb68 Mon Sep 17 00:00:00 2001
From: sparkyx <danydb@noalyss.eu>
Date: Sun, 29 Aug 2021 10:59:01 +0200
Subject: [PATCH] security

---
 html/export.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/html/export.php b/html/export.php
index 9b5044c2c..b26a20ff9 100644
--- a/html/export.php
+++ b/html/export.php
@@ -49,7 +49,7 @@ if ( $action=='X'  || $g_user->check_print($action)==0 )
 // get file and execute it
 
  $prfile=$cn->get_value("select me_file from menu_ref where me_code=$1",array($action));
- if ( $prfile == "") {
+ if ( $prfile == "" || !file_exists(NOALYSS_INCLUDE."/export/$prfile")) {
      print $action;
      die (_('Export impossible'));
  }