smirea/roomAllocation — pull request #1 by nashe (2014-02-04 22:24:37+00:00)
Title: Fix LFI in proxy.php

Hi,

The file **proxy.php** is vulnerable to local file inclusion. It's possible to read any file from the filesystem; e.g. /etc/issue by requesting http://roomallocation.code4fun.de/proxy.php?q=/etc/issue, /etc/passwd, etc.

This fix checks that the file in `$_GET['q']` exists in the current directory, doesn't contains any "../" or null bytes.