* Validate that the source path is authorized.

* Add site warning message if local_import is installed an there is no
  authorized directories

1 files changed, 6 insertions, 0 deletions

diff --git a/modules/local_import/controllers/local_import.php b/modules/local_import/controllers/local_import.php
index d5a1662a..9dcb108b 100644
--- a/modules/local_import/controllers/local_import.php
+++ b/modules/local_import/controllers/local_import.php
@@ -63,6 +63,12 @@ class Local_Import_Controller extends Controller {
     }
 
     $path = $this->input->post("path");
+
+    $paths = unserialize(module::get_var("local_import", "authorized_paths"));
+    if (empty($paths[$path[0]])) {
+      throw new Exception("@todo BAD_PATH");
+    }
+
     batch::operation("add", $parent);
 
     $source_path = $path[0];