Update path_helper.php

Protect against RFI via php:// wrapper

1 files changed, 1 insertions, 1 deletions

diff --git a/system/helpers/path_helper.php b/system/helpers/path_helper.php
index 838ece9e9..f3757affb 100644
--- a/system/helpers/path_helper.php
+++ b/system/helpers/path_helper.php
@@ -61,7 +61,7 @@ if ( ! function_exists('set_realpath'))
 	function set_realpath($path, $check_existance = FALSE)
 	{
 		// Security check to make sure the path is NOT a URL. No remote file inclusion!
-		if (preg_match('#^(http:\/\/|https:\/\/|www\.|ftp)#i', $path) OR filter_var($path, FILTER_VALIDATE_IP) === $path )
+		if (preg_match('#^(http:\/\/|https:\/\/|www\.|ftp|php)#i', $path) OR filter_var($path, FILTER_VALIDATE_IP) === $path )
 		{
 			show_error('The path you submitted must be a local server path, not a URL');
 		}