A hole in global.php 1.7.6 ??????

[4dabdura]

hello everybody it's my first post here, great script thanks to coders, ok to the subject now
not sure if i'm posting in right section....
I understand neither PHP nor Chinese but here's what i found:

http://bbs.wolvez.org/topic/56/
http://www.sebug.net/vulndb/4766/

what these supposed to mean? is there a hole in 1.7.6 global.php

[kai]

Please use this fix:

In global.php find:

if ($requested_l != $config['language_dir'] && file_exists(ROOT_PATH.'lang/'.$requested_l.'/main.php')) {

Replace with:

if (!preg_match('#\.\.[\\\/]#', $requested_l) && $requested_l != $config['language_dir'] && file_exists(ROOT_PATH.'lang/'.$requested_l.'/main.php')) {

[4dabdura]

thanks for great support