Restrict v-make-tmp-file to tmp folder

web/api/index.php

@@ -104,7 +104,7 @@ if (isset($_POST['user']) || isset($_POST['hash'])) {
     // Check command
     if ($cmd == "'v-make-tmp-file'") {
         // Used in DNS Cluster
-        $fp = fopen($_POST['arg2'], 'w');
+        $fp = fopen('/tmp/'.basename($_POST['arg2']), 'w');
         fwrite($fp, $_POST['arg1']."\n");
         fclose($fp);
         $return_var = 0;