GNUsocial
/
gnu-social
4
0
Fork 1
Code Issues Releases Wiki Activity

Validate action parameter 

Make sure the action request parameter only consists of a-z, A-Z, 0-9, _ or -
to discourage tampering with the following require_once.

darcs-hash:20080704194114-2b4f5-2bec30d7d40d7c7bd2c747ef3c805dbf720f6159.gz
This commit is contained in:
Gina Haeussge 2008-07-04 15:41:14 -04:00
parent 017bbd3b0f
commit e3e047b24a
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
index.php
View File

@ -24,7 +24,7 @@ require_once(INSTALLDIR . "/lib/common.php");
$action = $_REQUEST['action'];
if (!$action) {
if (!$action || !preg_match('/^[a-zA-Z0-9_-]*$/', $action)) {
common_redirect(common_local_url('public'));
}