Fix for ticket #1279. In admin themes sanitize the theme name before checking that theme.info exists.

2 files changed, 5 insertions, 4 deletions

diff --git a/modules/gallery/controllers/admin_themes.php b/modules/gallery/controllers/admin_themes.php
index e59eadaf..a88e1e89 100644
--- a/modules/gallery/controllers/admin_themes.php
+++ b/modules/gallery/controllers/admin_themes.php
@@ -31,10 +31,11 @@ class Admin_Themes_Controller extends Admin_Controller {
   private function _get_themes() {
     $themes = array();
     foreach (scandir(THEMEPATH) as $theme_name) {
+      if ($theme_name[0] == ".") {
+        continue;
+      }
+      $theme_name = preg_replace("/[^a-zA-Z0-9\._-]/", "", $theme_name);
       if (file_exists(THEMEPATH . "$theme_name/theme.info")) {
-        if ($theme_name[0] == ".") {
-          continue;
-        }
 
         $themes[$theme_name] = theme::get_info($theme_name);
       }
diff --git a/modules/gallery/helpers/theme.php b/modules/gallery/helpers/theme.php
index 3589a5b7..9df3eaf2 100644
--- a/modules/gallery/helpers/theme.php
+++ b/modules/gallery/helpers/theme.php
@@ -111,7 +111,7 @@ class theme_Core {
   }
 
   static function get_info($theme_name) {
-    $theme_name = preg_replace("/[^\w]/", "", $theme_name);
+    $theme_name = preg_replace("/[^a-zA-Z0-9\._-]/", "", $theme_name);
     $file = THEMEPATH . "$theme_name/theme.info";
     $theme_info = new ArrayObject(parse_ini_file($file), ArrayObject::ARRAY_AS_PROPS);
     $theme_info->description = t($theme_info->description);