fixes #699, make sure $_GET['tab'] does not include unexpected chars

admin.php

@@ -159,6 +159,11 @@ else
 $link_start = PHPWG_ROOT_PATH.'admin.php?page=';
 $conf_link = $link_start.'configuration&section=';
 
+// $_GET['tab'] is often used to perform and
+// include('admin_page_'.$_GET['tab'].'.php') : we need to protect it to
+// avoid any unexpected file inclusion
+check_input_parameter('tab', $_GET, false, '/^[a-zA-Z\d_-]+$/');
+
 // +-----------------------------------------------------------------------+
 // | Template init                                                         |
 // +-----------------------------------------------------------------------+