We are no longer offering accounts on this server. Consider https://gitlab.freedesktop.org/ as a place to host projects.

Commit e3e047b2 authored by Gina Haeussge's avatar Gina Haeussge

Validate action parameter

Make sure the action request parameter only consists of a-z, A-Z, 0-9, _ or -
to discourage tampering with the following require_once.

parent 017bbd3b
......@@ -24,7 +24,7 @@ require_once(INSTALLDIR . "/lib/common.php");
$action = $_REQUEST['action'];
if (!$action) {
if (!$action || !preg_match('/^[a-zA-Z0-9_-]*$/', $action)) {
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment