summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGina Haeussge <osd@foosel.net>2008-07-04 15:41:14 -0400
committerGina Haeussge <osd@foosel.net>2008-07-04 15:41:14 -0400
commite3e047b24ad021c3b3af25f97eea343893ecc1e3 (patch)
tree21bfbf195b95b05a6b256289c56cfb911f4b5e6a
parent017bbd3b0ff10c2ec2d31a47c39c1c34ca8558b2 (diff)
Validate action parameter
Make sure the action request parameter only consists of a-z, A-Z, 0-9, _ or - to discourage tampering with the following require_once. darcs-hash:20080704194114-2b4f5-2bec30d7d40d7c7bd2c747ef3c805dbf720f6159.gz
-rw-r--r--index.php2
1 files changed, 1 insertions, 1 deletions
diff --git a/index.php b/index.php
index 53fd1bfe6..514146c78 100644
--- a/index.php
+++ b/index.php
@@ -24,7 +24,7 @@ require_once(INSTALLDIR . "/lib/common.php");
$action = $_REQUEST['action'];
-if (!$action) {
+if (!$action || !preg_match('/^[a-zA-Z0-9_-]*$/', $action)) {
common_redirect(common_local_url('public'));
}