From: Gina Haeussge <osd@foosel.net>
Date: Fri, 4 Jul 2008 19:41:14 +0000 (-0400)
Subject: Validate action parameter
X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=e3e047b24ad021c3b3af25f97eea343893ecc1e3;p=quix0rs-gnu-social.git

Validate action parameter

Make sure the action request parameter only consists of a-z, A-Z, 0-9, _ or -
to discourage tampering with the following require_once.

darcs-hash:20080704194114-2b4f5-2bec30d7d40d7c7bd2c747ef3c805dbf720f6159.gz
---

diff --git a/index.php b/index.php
index 53fd1bfe66..514146c78d 100644
--- a/index.php
+++ b/index.php
@@ -24,7 +24,7 @@ require_once(INSTALLDIR . "/lib/common.php");
 
 $action = $_REQUEST['action'];
 
-if (!$action) {
+if (!$action || !preg_match('/^[a-zA-Z0-9_-]*$/', $action)) {
 	common_redirect(common_local_url('public'));
 }