Skip to content
Permalink
Browse files Browse the repository at this point in the history
fixes #574, new checks on plugin section in URL
  • Loading branch information
plegall committed Jan 1, 2017
1 parent beee647 commit 9004fdf
Showing 1 changed file with 7 additions and 1 deletion.
8 changes: 7 additions & 1 deletion admin/plugin.php
Expand Up @@ -32,10 +32,16 @@
$sections = explode('/', $_GET['section'] );
for ($i=0; $i<count($sections); $i++)
{
if (empty($sections[$i]) or $sections[$i]=='..')
if (empty($sections[$i]))
{
unset($sections[$i]);
$i--;
continue;
}

if ($sections[$i] == '..' or !preg_match('/^[a-zA-Z_\.-]+$/', $sections[$i]))
{
die('invalid section token ['.htmlentities($sections[$i]).']');
}
}

Expand Down

0 comments on commit 9004fdf

Please sign in to comment.