Flash: Sanitize id (allow only letters, digits and underscore).

moxiecode · Jan 23, 2013 · 2d746ee · 2d746ee
1 parent a081f64
commit 2d746ee
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/flash/plupload/src/com/plupload/Plupload.as b/src/flash/plupload/src/com/plupload/Plupload.as
@@ -77,7 +77,7 @@ package com.plupload {
 			// Security.allowDomain("*");
 
 			// Setup id
-			this.id = this.stage.loaderInfo.parameters["id"];
+			this.id = (this.stage.loaderInfo.parameters["id"]).toString().replace(/[^\w]/g, ''); // allow only [a-zA-Z0-9_]
 
 			// Setup file reference list
 			this.fileRefList = new FileReferenceList();