CVE-2022-4606: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') (CWE-98)
value: PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3.
CWE description: The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
CVSS v3 base score: 9.8
Published: 2022-12-18T13:15Z
Repository: https://github.com/flatpressblog/flatpress
Language: Unknown
Commit date: 2022-10-08 13:43:33 +0200
Commit message: Merge branch 'master' of https://github.com/flatpressblog/flatpress into issue94_smartyupdate

# resolved conflicts:
#	fp-includes/smarty/plugins/function.html_select_date.php

Diff: diff --cc CHANGELOG.md
index 955da44,eb42af3..cf05282
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@@ -1,37 -1,47 +1,50 @@@
  # Under development: [FlatPress 1.3](https://github.com/flatpressblog/flatpress/releases/tag/1.3)
  ## General
 +- Template engine Smarty updated to version 4.1.0 (see [#94](https://github.com/flatpressblog/flatpress/issues/94))
 +  - From now on, FlatPress requires at least PHP 7.1!
 +  - Please make sure your themes and plugins continue to work with the new Smarty version
  - Added [SECURITY.md](https://github.com/flatpressblog/flatpress/blob/master/SECURITY.md)
  - [README](https://github.com/flatpressblog/flatpress/blob/master/README.md): added "help and support" section
  
  ## Plugins
- - Gallery captions plugin added (see [#108](https://github.com/flatpressblog/flatpress/issues/108))
- - PhotoSwipe plugin added (see [#109](https://github.com/flatpressblog/flatpress/issues/109))
+ - Gallery captions plugin added ([#108](https://github.com/flatpressblog/flatpress/issues/108))
+ - PhotoSwipe plugin added ([#109](https://github.com/flatpressblog/flatpress/issues/109))
  - jQuery plugin: Updated jQuery (3.5.1 => 3.6) and jQueryUI (1.12.1 => 1.13.1)
  - Media Manager plugin shows 50 items per page, not 10
+ - LastComments plugin will not even attempt to delete or rebuild LastComments caches if LastComments plugin is not available ([#43](https://github.com/flatpressblog/flatpress/issues/43))
+ - Comment Center config page threw errors ([#90](https://github.com/flatpressblog/flatpress/issues/90))
  
  ## Themes
- - Leggero theme: Fixed searchbox glitch in FlatMaas revisited style (see [#97](https://github.com/flatpressblog/flatpress/issues/97))
- - Leggero theme: Fixed missing bullets in preview (see [#98](https://github.com/flatpressblog/flatpress/issues/98))
- - Leggero theme: CSS of the Leggero style had some glitches on mobile devices
- - Leggero theme: Invalid HTML output fixed (see [#106](https://github.com/flatpressblog/flatpress/issues/106))
- - Leggero theme: Removed unneccessary external font resource (see [#112](https://github.com/flatpressblog/flatpress/issues/112))
+ - Leggero
+   - Fixed searchbox glitch in FlatMaas revisited style ([#97](https://github.com/flatpressblog/flatpress/issues/97))
+   - Fixed missing bullets in preview ([#98](https://github.com/flatpressblog/flatpress/issues/98))
+   - CSS of the Leggero style had some glitches on mobile devices
+   - Invalid HTML output fixed ([#106](https://github.com/flatpressblog/flatpress/issues/106), [#156](https://github.com/flatpressblog/flatpress/issues/156))
+   - Removed unneccessary external font resource ([#112](https://github.com/flatpressblog/flatpress/issues/112))
+   - "Add comment" link has its own line ([#135](https://github.com/flatpressblog/flatpress/issues/135))
+   - Removed legacy/invalid CSS ([#133](https://github.com/flatpressblog/flatpress/issues/133), [#134](https://github.com/flatpressblog/flatpress/issues/134))
+   - Fixed description of Leggero and Leggero v2 styles ([#137](https://github.com/flatpressblog/flatpress/issues/137))
+   - Obsolete bullet points removed ([#136](https://github.com/flatpressblog/flatpress/issues/136))
+   - Updated preview image ([#139](https://github.com/flatpressblog/flatpress/issues/139))
  
- ## Bugfixes
- - Comment Center config page threw errors (see [#90](https://github.com/flatpressblog/flatpress/issues/90))
+ ## Internationalization
  - Fixed glitches in Spanish an Portuguese language files
+ - Fixed wrong pt-br country code ([#100](https://github.com/flatpressblog/flatpress/issues/100))
+ - Search page: Month names displayed in configured frontend language ([#132](https://github.com/flatpressblog/flatpress/issues/132))
+ - German translation for Comment Center plugin added ([#148](https://github.com/flatpressblog/flatpress/issues/148))
+ 
+ ## Other bugfixes
  - Plugin management page: Removed empty warning messages box
- - Fixed wrong pt-br country code (see [#100](https://github.com/flatpressblog/flatpress/issues/100))
- - Fixed error at prev link on first / next link on last entry (see [#95](https://github.com/flatpressblog/flatpress/issues/95))
- - LastComments plugin will not even attempt to delete or rebuild LastComments caches if LastComments plugin is not available (see [#43](https://github.com/flatpressblog/flatpress/issues/43))
+ - Fixed error at prev link on first / next link on last entry ([#95](https://github.com/flatpressblog/flatpress/issues/95))
+ - Logout redirects to home page again ([#119](https://github.com/flatpressblog/flatpress/issues/119))
+ - Fixed disappearing non-Latin characters in page title ([#49](https://github.com/flatpressblog/flatpress/issues/49) and [#91](https://github.com/flatpressblog/flatpress/issues/91))
  
  ## Security
- - Fixed security issue reported by huntr.dev: Session cookie missed the "secure" flag
+ - Possible XSS prevented: Session cookie missed the "secure" and "httponly" flags
  - Possible path traversal in Media Manager plugin prevented
+ - Uploaded files wheren't checked properly ([#152](https://github.com/flatpressblog/flatpress/issues/152))
  
  # 2021-06-19: [FlatPress 1.2.1](https://github.com/flatpressblog/flatpress/releases/tag/1.2.1)
  ## Bugfixes
  - BOM in French language files lead to blank page in admin area (see [#82](https://github.com/flatpressblog/flatpress/issues/82))
  ## Translations
diff --cc README.md
index bc4b033,df671ea..69a7d27
--- a/README.md
+++ b/README.md
@@@ -35,13 -35,9 +35,9 @@@ Installing and running FlatPress is rea
  Visit our [wiki](https://wiki.flatpress.org) to learn everything about blogging with FlatPress, how to work with themes and plugins and where to find them. The wiki also has the [general FAQ](https://wiki.flatpress.org/doc:faq) and the [tech FAQ](https://wiki.flatpress.org/doc:techfaq).
  
  Ask your questions, show off your FlatPress blog and meet fellow FlatPressers at the [support forum](https://forum.flatpress.org).
  
  ## Requirements
 -FlatPress runs on any web server (e.g. Apache or IIS) with PHP 5.6 or higher. Since all data is stored in files, no database is needed.
 +FlatPress runs on any web server (e.g. Apache or IIS) with PHP 7.1 or higher. Since all data is stored in files, no database is needed.
  
  ## Credits
  There are many people who contributed to FlatPress over the years. [See them here.](./CONTRIBUTORS.md)
- 
- 
- <a href="https://fosstodon.org/users/flatpress/remote_follow" title="Follow on Mastodon"><img alt="Mastodon Follow" src="https://img.shields.io/mastodon/follow/326815?domain=https%3A%2F%2Ffosstodon.org&style=social" alt="Follow on Mastodon"></a><br>
- <a href="https://twitter.com/intent/follow?screen_name=flatpress" title="Follow on Twitter"><img src="https://img.shields.io/twitter/follow/flatpress.svg?style=social&logo=twitter" alt="Follow on Twitter"></a>