]> git.mxchange.org Git - quix0rs-gnu-social.git/commitdiff
fix local file include vulnerability in doc.php
authorEvan Prodromou <evan@status.net>
Mon, 1 Feb 2010 16:10:36 +0000 (11:10 -0500)
committerEvan Prodromou <evan@status.net>
Mon, 1 Feb 2010 16:10:36 +0000 (11:10 -0500)
Conflicts:

actions/doc.php

actions/doc.php

index 25d363472a2cca2feadf3d1292c1d226c64f8bd5..eaf4b7df2d8f0b62365b718cca266ffe572ac1f8 100644 (file)
@@ -54,6 +54,9 @@ class DocAction extends Action
         parent::prepare($args);
 
         $this->title  = $this->trimmed('title');
+        if (!preg_match('/^[a-zA-Z0-9_-]*$/', $this->title)) {
+            $this->title = 'help';
+        }
         $this->output = null;
 
         $this->loadDoc();