- bug 207 fixed : security issue. Any visitor can reach any picture in

picture.php only by deleting value for URL parameter "cat".


git-svn-id: http://piwigo.org/svn/trunk@934 68402e56-0260-453c-a942-63ccdbb3a9ee

picture.php

@@ -31,6 +31,12 @@ define('PHPWG_ROOT_PATH','./');
 include_once(PHPWG_ROOT_PATH.'include/common.inc.php');
 //-------------------------------------------------- access authorization check
 check_cat_id( $_GET['cat'] );
+
+if (!isset($page['cat']))
+{
+  die($lang['access_forbiden']);
+}
+
 check_login_authorization();
 if ( isset( $page['cat'] ) and is_numeric( $page['cat'] ) )
 {