added validation for themename - see SC #101; merged from MOODLE_15_S…

…TABLE
moodle · Jul 5, 2005 · ab25ce3 · ab25ce3
1 parent 4726393
commit ab25ce3
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/lib/weblib.php b/lib/weblib.php
@@ -2013,6 +2013,8 @@ function style_sheet_setup($lastmodified=0, $lifetime=300, $themename='', $force
 
     if (empty($themename)) {
         $themename = current_theme();  // So we have something.  Normally not needed.
+    } else {
+        $themename = clean_param($themename, PARAM_SAFEDIR);
     }
 
     if (!empty($forceconfig)) {        // Page wants to use the config from this theme instead