aboutsummaryrefslogtreecommitdiffstats
path: root/include/functions.inc.php
diff options
context:
space:
mode:
authorplegall <plg@piwigo.org>2015-01-08 13:09:38 +0000
committerplegall <plg@piwigo.org>2015-01-08 13:09:38 +0000
commit2365113e9194803e546be0a65bd60b65542bf53d (patch)
tree648bd890f433e5ffe79db559cce7f47cec8400d1 /include/functions.inc.php
parent8758dd626b62525a5936fb3b1df06f38d90b1b3f (diff)
merge r30864 from trunk to branch 2.5
bug 3186: improved security on search.php git-svn-id: http://piwigo.org/svn/branches/2.5@30865 68402e56-0260-453c-a942-63ccdbb3a9ee
Diffstat (limited to 'include/functions.inc.php')
-rw-r--r--include/functions.inc.php4
1 files changed, 2 insertions, 2 deletions
diff --git a/include/functions.inc.php b/include/functions.inc.php
index edc56979b..42b187bbd 100644
--- a/include/functions.inc.php
+++ b/include/functions.inc.php
@@ -1565,9 +1565,9 @@ function check_input_parameter($param_name, $param_array, $is_array, $pattern)
fatal_error('[Hacking attempt] the input parameter "'.$param_name.'" should be an array');
}
- foreach ($param_value as $item_to_check)
+ foreach ($param_value as $key => $item_to_check)
{
- if (!preg_match($pattern, $item_to_check))
+ if (!preg_match(PATTERN_ID, $key) or !preg_match($pattern, $item_to_check))
{
fatal_error('[Hacking attempt] an item is not valid in input parameter "'.$param_name.'"');
}