summaryrefslogtreecommitdiff
path: root/actions/doc.php
diff options
context:
space:
mode:
authorEvan Prodromou <evan@status.net>2010-02-01 11:10:36 -0500
committerEvan Prodromou <evan@status.net>2010-02-01 11:10:36 -0500
commitd264db61199789bd6b2e42161048da69ce95f45a (patch)
treeb1905924bcf3fd4397805a63aac3e9b5bc481274 /actions/doc.php
parent779204b194447397d0770d96e291d9491fd731b9 (diff)
fix local file include vulnerability in doc.php
Conflicts: actions/doc.php
Diffstat (limited to 'actions/doc.php')
-rw-r--r--actions/doc.php3
1 files changed, 3 insertions, 0 deletions
diff --git a/actions/doc.php b/actions/doc.php
index 25d363472..eaf4b7df2 100644
--- a/actions/doc.php
+++ b/actions/doc.php
@@ -54,6 +54,9 @@ class DocAction extends Action
parent::prepare($args);
$this->title = $this->trimmed('title');
+ if (!preg_match('/^[a-zA-Z0-9_-]*$/', $this->title)) {
+ $this->title = 'help';
+ }
$this->output = null;
$this->loadDoc();