Sanitize addon path items

[friendica.git] / src / Core / L10n.php

diff --git a/src/Core/L10n.php b/src/Core/L10n.php
index f7ed9918ce7bd8feb139774ab2676074aed1aff9..ae0ed18c3d0a732364bfc5d53ca072f935f253cf 100644 (file)
--- a/src/Core/L10n.php
+++ b/src/Core/L10n.php
@@ -6,6 +6,7 @@ namespace Friendica\Core;
 
 use Friendica\BaseObject;
 use Friendica\Database\DBA;
+use Friendica\Util\Strings;
 
 /**
  * Provide Language, Translation, and Localization functions to the application
@@ -193,6 +194,8 @@ class L10n extends BaseObject
         */
        private static function loadTranslationTable($lang)
        {
+               $lang = Strings::sanitizeFilePathItem($lang);
+
                if ($lang === self::$lang) {
                        return;
                }
@@ -203,7 +206,7 @@ class L10n extends BaseObject
                // load enabled addons strings
                $addons = DBA::select('addon', ['name'], ['installed' => true]);
                while ($p = DBA::fetch($addons)) {
-                       $name = $p['name'];
+                       $name = Strings::sanitizeFilePathItem($p['name']);
                        if (file_exists("addon/$name/lang/$lang/strings.php")) {
                                include "addon/$name/lang/$lang/strings.php";
                        }