first commit

wp-content/plugins/brizy/admin/guafrette/local-adapter.php

@@ -0,0 +1,41 @@
+<?php
+use Gaufrette\Adapter\Local as OriginalLocalAdapter;
+
+class Brizy_Admin_Guafrette_LocalAdapter extends OriginalLocalAdapter{
+
+	private $create;
+	private $mode;
+
+	/**
+	 * @param string $directory Directory where the filesystem is located
+	 * @param bool   $create    Whether to create the directory if it does not
+	 *                          exist (default FALSE)
+	 * @param int    $mode      Mode for mkdir
+	 *
+	 * @throws RuntimeException if the specified directory does not exist and
+	 *                          could not be created
+	 */
+	public function __construct($directory, $create = false, $mode = 0777)
+	{
+		$this->directory = Brizy_Admin_Guafrette_Path::normalize($directory);
+
+		if (is_link($this->directory)) {
+			$this->directory = realpath($this->directory);
+		}
+
+		$this->create = $create;
+		$this->mode = $mode;
+	}
+
+	protected function normalizePath($path)
+	{
+		$path = Brizy_Admin_Guafrette_Path::normalize($path);
+
+		if (0 !== strpos($path, $this->directory)) {
+			throw new \OutOfBoundsException(sprintf('The path "%s" is out of the filesystem.', $path));
+		}
+
+		return $path;
+	}
+
+}

wp-content/plugins/brizy/admin/guafrette/path.php

@@ -0,0 +1,46 @@
+<?php
+
+use Gaufrette\Util\Path as OriginalPath;
+/**
+ * Path utils.
+ *
+ * @author  Antoine Hérault <antoine.herault@gmail.com>
+ */
+class Brizy_Admin_Guafrette_Path extends OriginalPath
+{
+    /**
+     * Normalizes the given path.
+     *
+     * @param string $path
+     *
+     * @return string
+     */
+    public static function normalize($path)
+    {
+        $path = str_replace('\\', '/', $path);
+        $prefix = static::getAbsolutePrefix($path);
+        $path = substr($path, strlen($prefix));
+        $parts = array_filter(explode('/', $path), 'strlen');
+        $tokens = array();
+
+        foreach ($parts as $part) {
+            switch ($part) {
+                case '.':
+                    continue 2;
+                case '..':
+                    if (0 !== count($tokens)) {
+                        array_pop($tokens);
+                        continue 2;
+                    } elseif (!empty($prefix)) {
+                        continue 2;
+                    }
+                default:
+                    $tokens[] = $part;
+            }
+        }
+
+        return $prefix.implode('/', $tokens);
+    }
+
+
+}