title: path injection in user input
body: <p>Hi on my php project The user send the name of the theme (it's a telegram desktop theme maker) via form input.
  (The project is hosted on github <a href="https://github.com/danielpetrica/Telegram-Desktop-themes-maker" rel="nofollow noreferrer">Github Project</a>)
  The problem is:
  I use this in the theme name the user could potentially access any folder on the serve.
  I tried to correct it with this commit : <a href="https://github.com/danielpetrica/Telegram-Desktop-themes-maker/commit/35216605d28c0a03ab173042f8c5be9b73ec3354" rel="nofollow noreferrer">Github commit</a></p>
  <pre><code>$theme_name = str_replace(&quot;/&quot;, &quot;_badyou_&quot;, $_GET[&quot;name&quot;]); //contains the good themename
  </code></pre>
  <p>I need the just the name so I thought that eliminating the &quot;/&quot; is enough.
  But I need the opinion of someone who actually knows php better than me.</p>
  <p>P.S sorry for my bad english.
  Thank you in advance.</p>