Sanitize the module name and don't allow storing values for illegal

module names.  Fixes #1898.

1 files changed, 17 insertions, 13 deletions

diff --git a/modules/gallery/controllers/admin_advanced_settings.php b/modules/gallery/controllers/admin_advanced_settings.php
index 1ce47529..752a2e81 100644
--- a/modules/gallery/controllers/admin_advanced_settings.php
+++ b/modules/gallery/controllers/admin_advanced_settings.php
@@ -30,24 +30,28 @@ class Admin_Advanced_Settings_Controller extends Admin_Controller {
   }
 
   public function edit($module_name, $var_name) {
-    $value = module::get_var($module_name, $var_name);
-    $form = new Forge("admin/advanced_settings/save/$module_name/$var_name", "", "post");
-    $group = $form->group("edit_var")->label(t("Edit setting"));
-    $group->input("module_name")->label(t("Module"))->value($module_name)->disabled(1);
-    $group->input("var_name")->label(t("Setting"))->value($var_name)->disabled(1);
-    $group->textarea("value")->label(t("Value"))->value($value);
-    $group->submit("")->value(t("Save"));
-    print $form;
+    if (module::is_installed($module_name)) {
+      $value = module::get_var($module_name, $var_name);
+      $form = new Forge("admin/advanced_settings/save/$module_name/$var_name", "", "post");
+      $group = $form->group("edit_var")->label(t("Edit setting"));
+      $group->input("module_name")->label(t("Module"))->value($module_name)->disabled(1);
+      $group->input("var_name")->label(t("Setting"))->value($var_name)->disabled(1);
+      $group->textarea("value")->label(t("Value"))->value($value);
+      $group->submit("")->value(t("Save"));
+      print $form;
+    }
   }
 
   public function save($module_name, $var_name) {
     access::verify_csrf();
 
-    module::set_var($module_name, $var_name, Input::instance()->post("value"));
-    message::success(
-      t("Saved value for %var (%module_name)",
-        array("var" => $var_name, "module_name" => $module_name)));
+    if (module::is_installed($module_name)) {
+      module::set_var($module_name, $var_name, Input::instance()->post("value"));
+      message::success(
+        t("Saved value for %var (%module_name)",
+          array("var" => $var_name, "module_name" => $module_name)));
 
-    json::reply(array("result" => "success"));
+      json::reply(array("result" => "success"));
+    }
   }
 }