Add parameter sanitization.

freemed · Dec 4, 2014 · c32c4f0 · c32c4f0
1 parent f811f95
commit c32c4f0
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/help.php b/help.php
@@ -30,6 +30,13 @@
 $parts = explode ( '/', $_SERVER['PATH_INFO'] );
 $ui = $parts[1];
 $locale = !empty($parts[2]) ? $parts[2] : "en_US";
+
+// Check for sanitized parameters
+if (!preg_match("/^[[:alpha:]]+$/", $ui) || !preg_match("/^[[:alpha:]_]+$/", $locale)) {
+	print "Hack attempt.\n";
+	die();
+}
+
 $path = str_replace ( $parts[0].'/'.$parts[1].'/'.$parts[2], '', $_SERVER['PATH_INFO'] );
 // Strip leading slash if it exists ...
 if ( substr( $path, 0, 1 ) == '/' ) {