This check doesn't work with symlinks, and It's look overly cautious, because the...

diff --git a/horde/services/prefs.php b/horde/services/prefs.php
index e524318..172e1ce 100644 (file)
--- a/horde/services/prefs.php
+++ b/horde/services/prefs.php
@@ -62,9 +62,8 @@ try {
 /* See if this group has a custom URL. */
 if ($group && !empty($prefGroups[$group]['url'])) {
     $pref_url = $prefGroups[$group]['url'];
-    $filename = realpath($appbase . '/' . $pref_url);
-    if (file_exists($filename) &&
-        (strpos($filename, $appbase) === 0)) {
+    $filename = $appbase . '/' . $pref_url;
+    if (file_exists($filename)) {
         require $filename;
         return;
     }