From: Brion Vibber <brion@status.net>
Date: Fri, 19 Nov 2010 23:30:52 +0000 (-0800)
Subject: Ticket #2796: don't allow arbitrary overriding of the 'action' class and other parame... 
X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=4193a826d3500c1c8771e2a55ca197011fe637c8;p=quix0rs-gnu-social.git

Ticket #2796: don't allow arbitrary overriding of the 'action' class and other parameters pulled from the URL mapper.

This protects against oddities such as manual invocation of the ClientError action, which can spoof error messages.
---

diff --git a/index.php b/index.php
index 9501e2275d..6079d1f2c4 100644
--- a/index.php
+++ b/index.php
@@ -272,7 +272,11 @@ function main()
         return;
     }
 
-    $args = array_merge($args, $_REQUEST);
+    // Note the order here: arguments from the URL mapper will
+    // override request params that have been sent. This ensures
+    // that for instance an action parameter can't be overridden
+    // with an arbitrary action class.
+    $args = array_merge($_REQUEST, $args);
 
     Event::handle('ArgsInitialize', array(&$args));