Changeset 11159

Timestamp:

May 31, 2011, 10:32:41 PM (13 years ago)

Author:

plg

Message:

merge r11157 from branch 2.2 to trunk

bug 2280 fixed: check language and theme values before updating database. The
posted value must match an expected value, this is not a free texfield.

File:

• trunk/profile.php (modified) (1 diff)

trunk/profile.php

@@ -149 +149 @@
     {
       $errors[] = l10n('Recent period must be a positive integer value') ;
+    }
+
+    if (!in_array($_POST['language'], array_keys(get_languages())))
+    {
+      die('Hacking attempt, incorrect language value');
+    }
+
+    if (!in_array($_POST['theme'], array_keys(get_pwg_themes())))
+    {
+      die('Hacking attempt, incorrect theme value');
     }
   }