fixes #667, check $_GET['page'] to avoid XSS

This can be an issue only on Internet Explorer

admin.php

@@ -41,6 +41,8 @@ trigger_notify('loc_begin_admin');
 
 check_status(ACCESS_ADMINISTRATOR);
 
+check_input_parameter('page', $_GET, false, '/^[a-zA-Z\d_-]+$/');
+
 // +-----------------------------------------------------------------------+
 // | Direct actions                                                        |
 // +-----------------------------------------------------------------------+