From c1e8f6f758caa8d9e92654215d9bb4399784c7ac Mon Sep 17 00:00:00 2001 From: plegall Date: Fri, 2 Jun 2017 10:12:00 +0200 Subject: [PATCH] (cp 3ae62ce) fixes #699, make sure $_GET['tab'] does not include unexpected chars --- admin.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/admin.php b/admin.php index fd97e73ba..bdd4abebe 100644 --- a/admin.php +++ b/admin.php @@ -159,6 +159,11 @@ else $link_start = PHPWG_ROOT_PATH.'admin.php?page='; $conf_link = $link_start.'configuration&section='; +// $_GET['tab'] is often used to perform and +// include('admin_page_'.$_GET['tab'].'.php') : we need to protect it to +// avoid any unexpected file inclusion +check_input_parameter('tab', $_GET, false, '/^[a-zA-Z\d_-]+$/'); + // +-----------------------------------------------------------------------+ // | Template init | // +-----------------------------------------------------------------------+