(cp 69345c0) fixes #847, CVE-2018-5692 protect a few user input variables

2026-08-06 16:53:34 +02:00 · 2018-07-11 11:24:59 +02:00
parent 0ec289769e
commit 18e4b86199
5 changed files with 8 additions and 0 deletions
@@ -42,6 +42,7 @@ trigger_notify('loc_begin_admin');
 check_status(ACCESS_ADMINISTRATOR);

 check_input_parameter('page', $_GET, false, '/^[a-zA-Z\d_-]+$/');
+check_input_parameter('section', $_GET, false, '/^[a-z]+[a-z_\/-]*(\.php)?$/i');

 // +-----------------------------------------------------------------------+
 // | Direct actions                                                        |