We can't do Paths::sanitize before we check if $attach is NULL because it'll ruin...

diff --git a/includes/controller.php b/includes/controller.php
index 09c0f2c258df8af2c303f93230d7ecf8cccaf0f1..f5d0337e27db667c15b041957e0abb548b91d626 100644 (file)
--- a/includes/controller.php
+++ b/includes/controller.php
@@ -179,7 +179,6 @@ class Controller
        function href_compound($base, $attach = null, $revstr = null)
        {
                $url = Paths::fetch_arguments($base . ($revstr === null ? ((strpos($base, '?') !== false) ? '&' . $this->revstr : $this->revstr) : $revstr));
-               $attach = Paths::sanitize($attach);
                
                if ($attach === null)
                {
@@ -187,6 +186,7 @@ class Controller
                }
                else
                {
+                       $attach = Paths::sanitize($attach);
                        $path = $this->path . (($attach[0] != '/' AND $this->path[ strlen($this->path) - 1 ] != '/') ? '/' : '') . $attach;
                }