Language: PHP
Label: vulnerable
CWE: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Code:
	private function validateDomainDocumentRoot($path = null, $url = null, $customer = null, $completedomain = null, &$_doredirect = false)
	{
		// check whether an URL was specified
		$_doredirect = false;
		if (!empty($url) && Validate::validateUrl($url, true)) {
			$path = $url;
			$_doredirect = true;
		} else {
			$path = Validate::validate($path, 'path', '', '', [], true);
		}

		// check whether path is a real path
		if (!preg_match('/^https?\:\/\//', $path) || !Validate::validateUrl($path, true)) {
			if (strstr($path, ":") !== false) {
				Response::standardError('pathmaynotcontaincolon', '', true);
			}
			// If path is empty or '/' and 'Use domain name as default value for DocumentRoot path' is enabled in settings,
			// set default path to subdomain or domain name
			if ((($path == '') || ($path == '/')) && Settings::Get('system.documentroot_use_default_value') == 1) {
				$path = FileDir::makeCorrectDir($customer['documentroot'] . '/' . $completedomain);
			} else {
				$path = FileDir::makeCorrectDir($customer['documentroot'] . '/' . $path);
			}
		} else {
			// no it's not, create a redirect
			$_doredirect = true;
		}
		return $path;
	}