From 2365113e9194803e546be0a65bd60b65542bf53d Mon Sep 17 00:00:00 2001 From: plegall Date: Thu, 8 Jan 2015 13:09:38 +0000 Subject: merge r30864 from trunk to branch 2.5 bug 3186: improved security on search.php git-svn-id: http://piwigo.org/svn/branches/2.5@30865 68402e56-0260-453c-a942-63ccdbb3a9ee --- include/functions.inc.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include/functions.inc.php') diff --git a/include/functions.inc.php b/include/functions.inc.php index edc56979b..42b187bbd 100644 --- a/include/functions.inc.php +++ b/include/functions.inc.php @@ -1565,9 +1565,9 @@ function check_input_parameter($param_name, $param_array, $is_array, $pattern) fatal_error('[Hacking attempt] the input parameter "'.$param_name.'" should be an array'); } - foreach ($param_value as $item_to_check) + foreach ($param_value as $key => $item_to_check) { - if (!preg_match($pattern, $item_to_check)) + if (!preg_match(PATTERN_ID, $key) or !preg_match($pattern, $item_to_check)) { fatal_error('[Hacking attempt] an item is not valid in input parameter "'.$param_name.'"'); } -- cgit v1.2.3