merge r30950 from trunk to branch 2.7

bug 3201 fixed: check plugin identifier git-svn-id: http://piwigo.org/svn/branches/2.7@30951 68402e56-0260-453c-a942-63ccdbb3a9ee
2026-06-02 04:15:05 +02:00 · 2015-02-12 14:35:42 +00:00
parent f07a61c105
commit c0608565da
1 changed files with 6 additions and 0 deletions
@@ -45,6 +45,12 @@ if (count($sections)<2)
 }

 $plugin_id = $sections[0];
+
+if (!preg_match('/^\w+$/', $plugin_id))
+{
+  die('Invalid plugin identifier');
+}
+
 if ( !isset($pwg_loaded_plugins[$plugin_id]) )
 {
  die('Invalid URL - plugin '.$plugin_id.' not active');