archive/piwigo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

merge r11157 from branch 2.2 to trunk

Browse source 
bug 2280 fixed: check language and theme values before updating database. The
posted value must match an expected value, this is not a free texfield.



git-svn-id: http://piwigo.org/svn/trunk@11159 68402e56-0260-453c-a942-63ccdbb3a9ee
This commit is contained in:
plegall 2011-05-31 20:32:41 +00:00
commit 70841e0f50
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
profile.php
View file

@ -149,6 +149,16 @@ function save_profile_from_post($userdata, &$errors)
{
$errors[] = l10n('Recent period must be a positive integer value') ;
}
if (!in_array($_POST['language'], array_keys(get_languages())))
{
die('Hacking attempt, incorrect language value');
}
if (!in_array($_POST['theme'], array_keys(get_pwg_themes())))
{
die('Hacking attempt, incorrect theme value');
}
}
if (isset($_POST['mail_address']))