Something that has bothered me bout the MOD Commander is the readme.asp. It's a slick idea, but I think there's a minor modification that should be made to it.
Right now you could read outside of the mod directory. 
The following example will get the gpl text file.
http://yourserver.com/forum/mods/readme.asp?readme=../gpl
Luckily, the only files it can read are .txt files because of this line:
rfile = request.querystring("readme") & ".txt"
But just in case, I'd recommend checking for the "/" character to restrict someone from trying to read outside of the mod directory, else restricting the readme.asp file to admin and moderator people.
If (InStr(rfile,"/")) Then
response.write ("Access outside the mod directory is restricted.")
Else
Set rfile1 = CreateObject("Scripting.FileSystemObject")
Set rfile2 = rfile1.OpenTextFile(server.mappath(rfile), 1, False)
do while not rfile2.AtEndOfStream
response.write HTMLEncode(rfile2.readline) & "<br>"
loop
rfile2.Close
set rfile2=nothing
set rfile1=nothing
End If
Hopefully this will not incur a rash of people's gpl files being read by others. 
Topic Locked
Posted - 15 March 2001 : 10:06:16
