From a0a20063fae703bccf10a60d3c3bb13222c339f3 Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Sat, 19 Sep 2026 21:01:05 -0700
Subject: [PATCH] Call correct function to check file paths

---
 apache/manual_form.cgi | 1 +
 apache/manual_save.cgi | 1 +
 2 files changed, 2 insertions(+)

diff --git a/apache/manual_form.cgi b/apache/manual_form.cgi
index 9554cc2bf..b9e03806d 100755
--- a/apache/manual_form.cgi
+++ b/apache/manual_form.cgi
@@ -35,6 +35,7 @@ if (defined($in{'virt'})) {
 		}
 	}
 else {
+	&allowed_auth_file($in{'file'}) || &error($text{'htindex_ecannot'});
 	if (defined($in{'idx'})) {
 		# files within .htaccess file
 		$hconf = &get_htaccess_config($in{'file'});
diff --git a/apache/manual_save.cgi b/apache/manual_save.cgi
index b6306b511..731229c1f 100755
--- a/apache/manual_save.cgi
+++ b/apache/manual_save.cgi
@@ -34,6 +34,7 @@ if (defined($in{'virt'})) {
 		}
 	}
 else {
+	&allowed_auth_file($in{'file'}) || &error($text{'htindex_ecannot'});
 	if (defined($in{'idx'})) {
 		# files within .htaccess file
 		$hconf = &get_htaccess_config($in{'file'});