diff options
| author | Adrian Lang <mail@adrianlang.de> | 2012-07-13 12:07:51 +0200 |
|---|---|---|
| committer | Adrian Lang <mail@adrianlang.de> | 2012-07-13 12:15:48 +0200 |
| commit | 96673b23e65e0853cbf2867a94abf3973ebc06f9 (patch) | |
| tree | 9c896ddaf865848c69dd80a3d397ba9d0ea33783 /lib | |
| parent | c0c314bf9821b3735d341bbf9d7977815bf83de2 (diff) | |
| download | rpg-96673b23e65e0853cbf2867a94abf3973ebc06f9.tar.gz rpg-96673b23e65e0853cbf2867a94abf3973ebc06f9.tar.bz2 | |
Fix HTML injection in mediaFileList (Secunia advisory SA49196)
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/exe/ajax.php | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/lib/exe/ajax.php b/lib/exe/ajax.php index 3d1584244..945091f34 100644 --- a/lib/exe/ajax.php +++ b/lib/exe/ajax.php @@ -13,7 +13,6 @@ session_write_close(); header('Content-Type: text/html; charset=utf-8'); - //call the requested function if(isset($_POST['call'])){ $call = $_POST['call']; @@ -204,7 +203,7 @@ function ajax_medialist(){ global $conf; global $NS; - $NS = $_POST['ns']; + $NS = cleanID($_POST['ns']); if ($_POST['do'] == 'media') { tpl_mediaFileList(); } else { |