Fixed FPD Exploit in ajax.php reported here: http://code.google.com/p…

…/thehostingtool/issues/detail?id=1
TheHostingTool · May 23, 2010 · e54e28d · e54e28d
1 parent 455f861
commit e54e28d
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/includes/ajax.php b/includes/ajax.php
@@ -1094,8 +1094,10 @@ function deleteTicket() {
 }
 if(isset($_GET['function']) and $_GET['function'] != "") {
 	$ajax = new AJAX;
-	$ajax->{$_GET['function']}();
-	include(LINK."output.php");
+	if(method_exists($ajax, $_GET['function'])) {
+		$ajax->{$_GET['function']}();
+		include(LINK."output.php");
+	}
 }
 
 ?>