Source: image (security level: low)
Flip the security level in the header to compare the vulnerable and fixed code paths.
<?php // LOW: the file path is used as-is -> path traversal / LFI-read (open_basedir confines it to the
// webroot, so system files are blocked, but any app source can be read -> source disclosure).
$f = isset($_GET['file']) ? $_GET['file'] : 'assets/shipping.txt';
// the viewer serves store documents; it must not expose the app's ops data (the visitor log under /var/lib).
// Stream wrappers (file://, php://filter, compress.zlib://, ...) are refused: realpath() does not resolve them, so they
// would walk straight past the /var/lib check.
$rp = realpath($f);
$content = (preg_match('#^[a-z][a-z0-9+.-]*:#i', $f) || ($rp !== false && strpos($rp, '/var/lib/') === 0)) ? false : @file_get_contents($f);