(cp 4310fe7) fixes #667, check $_GET['page'] to avoid XSS

This can be an issue only on Internet Explorer
2026-05-18 15:26:12 +02:00 · 2017-06-12 11:38:00 +02:00
parent c1e8f6f758
commit 1b22d08a80
1 changed files with 2 additions and 0 deletions
@@ -41,6 +41,8 @@ trigger_notify('loc_begin_admin');

 check_status(ACCESS_ADMINISTRATOR);

+check_input_parameter('page', $_GET, false, '/^[a-zA-Z\d_-]+$/');
+
 // +-----------------------------------------------------------------------+
 // | Direct actions                                                        |
 // +-----------------------------------------------------------------------+