filter special chars from ajax call parameter. fixes #2019

dokuwiki · Jun 27, 2017 · 238b8e8 · 238b8e8 · splitbrain · Jun 27, 2017
1 parent e301b16
commit 238b8e8
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/lib/exe/ajax.php b/lib/exe/ajax.php
@@ -15,9 +15,9 @@
 
 //call the requested function
 if($INPUT->post->has('call')){
-    $call = $INPUT->post->str('call');
+    $call = $INPUT->post->filter('utf8_stripspecials')->str('call');
 }else if($INPUT->get->has('call')){
-    $call = $INPUT->get->str('call');
+    $call = $INPUT->get->filter('utf8_stripspecials')->str('call');
 }else{
     exit;
 }