make sure we don't try to include whole directories (from unsafe input like "?.js")

1 files changed, 1 insertions, 1 deletions

diff --git a/itjs.class b/itjs.class
index 44e2879..702051d 100644
--- a/itjs.class
+++ b/itjs.class
@@ -119,7 +119,7 @@ static function filenames($filelist)
 		$filenames = $special[$file] ?: (file_exists("$local/" . it::match('^[^?]*', $file)) ? "$local/$file" : "$libsearch/itjs/$file");
 
 		foreach (explode(",", $filenames) as $filename)
-			if (!$seen[$filename]++ && file_exists(it::match('^[^?]*', $filename)))
+			if (!$seen[$filename]++ && file_exists(($fn = it::match('^[^?]*', $filename))) && is_file($fn))
 				$result[] = $filename;
 	}