merge r30864 from trunk to branch 2.6

bug 3186: improved security on search.php


git-svn-id: http://piwigo.org/svn/branches/2.6@30866 68402e56-0260-453c-a942-63ccdbb3a9ee

1 files changed, 2 insertions, 2 deletions

diff --git a/include/functions.inc.php b/include/functions.inc.php
index a08bd94b4..a3feb477b 100644
--- a/include/functions.inc.php
+++ b/include/functions.inc.php
@@ -1887,9 +1887,9 @@ function check_input_parameter($param_name, $param_array, $is_array, $pattern, $
       fatal_error('[Hacking attempt] the input parameter "'.$param_name.'" should be an array');
     }
 
-    foreach ($param_value as $item_to_check)
+    foreach ($param_value as $key => $item_to_check)
     {
-      if (!preg_match($pattern, $item_to_check))
+      if (!preg_match(PATTERN_ID, $key) or !preg_match($pattern, $item_to_check))
       {
         fatal_error('[Hacking attempt] an item is not valid in input parameter "'.$param_name.'"');
       }