From 8796e43aa344681d92a92e1f9b985409d4f36e31 Mon Sep 17 00:00:00 2001
From: plegall <plg@piwigo.org>
Date: Sun, 1 Jan 2017 19:42:04 +0100
Subject: [PATCH] fixes #574, new checks on plugin section in URL

git cherry-pick 9004fdfc0b4a11cb32e9e15a5f67e4ec827e82dc
---
 admin/plugin.php | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/admin/plugin.php b/admin/plugin.php
index 16de979a5..704c3ad5e 100644
--- a/admin/plugin.php
+++ b/admin/plugin.php
@@ -32,10 +32,16 @@ check_status(ACCESS_ADMINISTRATOR);
 $sections = explode('/', $_GET['section'] );
 for ($i=0; $i<count($sections); $i++)
 {
-  if (empty($sections[$i]) or $sections[$i]=='..')
+  if (empty($sections[$i]))
   {
     unset($sections[$i]);
     $i--;
+    continue;
+  }
+
+  if ($sections[$i] == '..' or !preg_match('/^[a-zA-Z_\.-]+$/', $sections[$i]))
+  {
+    die('invalid section token ['.htmlentities($sections[$i]).']');
   }
 }