Changeset 11157

Timestamp:

May 31, 2011, 10:32:16 PM (13 years ago)

Author:

plg

Message:

bug 2280 fixed: check language and theme values before updating database. The
posted value must match an expected value, this is not a free texfield.

File:

• branches/2.2/profile.php (modified) (1 diff)

branches/2.2/profile.php

@@ -147 +147 @@
     {
       $errors[] = l10n('Recent period must be a positive integer value') ;
+    }
+
+    if (!in_array($_POST['language'], array_keys(get_languages())))
+    {
+      die('Hacking attempt, incorrect language value');
+    }
+
+    if (!in_array($_POST['theme'], array_keys(get_pwg_themes())))
+    {
+      die('Hacking attempt, incorrect theme value');
     }
   }