From dedf55cba23abc1536ab7a7a6816f3743bc25cbb Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Sun, 20 Sep 2026 12:15:21 -0700
Subject: [PATCH] Make extra sure that search results are under allowed paths

---
 filemin/search.cgi | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/filemin/search.cgi b/filemin/search.cgi
index 115d65445..31e401849 100755
--- a/filemin/search.cgi
+++ b/filemin/search.cgi
@@ -24,6 +24,15 @@ else {
 	"find ".quotemeta($cwd).
 	" $criteria ".
 	quotemeta("*$in{'query'}*")));
+if (&test_allowed_paths()) {
+	foreach my $path (@allowed_paths) {
+		my $slashed = $path;
+		$slashed .= "/" if ($slashed !~ /\/$/);
+		@list = grep { $_ eq $path ||
+			       $_ =~ /^\Q$slashed\E/ } @list;
+		}
+	@list = &unique(@list);
+	}
 @list = map {
 	[$_, stat($_), &clean_mimetype($_), -d $_]
 	} @list;