summaryrefslogtreecommitdiff
path: root/actions
diff options
context:
space:
mode:
Diffstat (limited to 'actions')
-rw-r--r--actions/doc.php4
1 files changed, 4 insertions, 0 deletions
diff --git a/actions/doc.php b/actions/doc.php
index e6508030b..fe5810579 100644
--- a/actions/doc.php
+++ b/actions/doc.php
@@ -59,6 +59,10 @@ class DocAction extends Action
{
parent::handle($args);
$this->title = $this->trimmed('title');
+ // Prevent local file include
+ if (!preg_match('/^[a-zA-Z0-9_-]*$/', $this->title)) {
+ $this->title = 'help';
+ }
$this->filename = INSTALLDIR.'/doc-src/'.$this->title;
if (!file_exists($this->filename)) {
$this->clientError(_('No such document.'));