From 400ea5b22a7d436f60499ea9f5d1dd95e0bc616b Mon Sep 17 00:00:00 2001
From: Oliver Hamlet <oliver.hamlet@gmail.com>
Date: Thu, 2 Jul 2015 16:52:06 +0100
Subject: [PATCH] Check for safe path in active condition.

Not strictly necessary, since all plugins are in the data folder, but
better to be consistent in case of future changes.
---
 src/backend/metadata/condition_grammar.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/backend/metadata/condition_grammar.h b/src/backend/metadata/condition_grammar.h
index 9ce2bc60..2cc16ad0 100644
--- a/src/backend/metadata/condition_grammar.h
+++ b/src/backend/metadata/condition_grammar.h
@@ -317,6 +317,11 @@ namespace loot {
             if (_parseOnly)
                 return;
 
+            if (!IsSafePath(file)) {
+                BOOST_LOG_TRIVIAL(error) << "Invalid file path: " << file;
+                throw loot::error(loot::error::invalid_args, boost::locale::translate("Invalid file path:").str() + " " + file);
+            }
+
             if (file == "LOOT")
                 result = false;
             else