diff --git a/web/views/image.php b/web/views/image.php index 53c3632bfa..29b2d59fca 100644 --- a/web/views/image.php +++ b/web/views/image.php @@ -20,7 +20,8 @@ // Calling sequence: ... /zm/index.php?view=image&path=/monid/path/image.jpg&scale=nnn&width=wwww&height=hhhhh // -// Path is physical path to the image starting at the monitor id +// Path is physical path to the image. +// If "path" starts with "/" - then the link is relative to the root (ZM_PATH_WEB), if there is no slash at the beginning, then it is relative to the skin folder (ZM_SKIN_PATH) // // Scale is optional and between 1 and 400 (percent), // Omitted or 100 = no scaling done, image passed through directly @@ -444,6 +445,9 @@ function imagescale($image, $new_width, $new_height = -1, $mode = 0) { return; } } # end if ! file_exists($path) +} else { + $path = (strpos(validHtmlStr($_REQUEST['path']), '/') == 0) ? ZM_PATH_WEB.validHtmlStr($_REQUEST['path']) : ZM_PATH_WEB.'/'.ZM_SKIN_PATH.'/'.validHtmlStr($_REQUEST['path']); + if ( !file_exists($path) ) return; } # we now load the actual image to send