From 1ad1f9517f91875875f2e062bda7d834827c3430 Mon Sep 17 00:00:00 2001 From: Tim Almdal Date: Sun, 8 Aug 2010 17:29:22 -0700 Subject: Fix for ticket #1279. In admin themes sanitize the theme name before checking that theme.info exists. --- modules/gallery/controllers/admin_themes.php | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'modules/gallery/controllers/admin_themes.php') diff --git a/modules/gallery/controllers/admin_themes.php b/modules/gallery/controllers/admin_themes.php index e59eadaf..a88e1e89 100644 --- a/modules/gallery/controllers/admin_themes.php +++ b/modules/gallery/controllers/admin_themes.php @@ -31,10 +31,11 @@ class Admin_Themes_Controller extends Admin_Controller { private function _get_themes() { $themes = array(); foreach (scandir(THEMEPATH) as $theme_name) { + if ($theme_name[0] == ".") { + continue; + } + $theme_name = preg_replace("/[^a-zA-Z0-9\._-]/", "", $theme_name); if (file_exists(THEMEPATH . "$theme_name/theme.info")) { - if ($theme_name[0] == ".") { - continue; - } $themes[$theme_name] = theme::get_info($theme_name); } -- cgit v1.2.3