diff options
| author | cash <cash.costello@gmail.com> | 2012-01-11 22:39:59 -0500 |
|---|---|---|
| committer | cash <cash.costello@gmail.com> | 2012-01-11 22:39:59 -0500 |
| commit | 0c1ee36d6aa220376537324d427741861e00138a (patch) | |
| tree | 8d7772fa484ce27ea1e9e69341c415e8b3efdccc /engine/lib/elgglib.php | |
| parent | a3f0353600e749a16abbdab3cbc75b3469d6fd69 (diff) | |
| download | elgg-0c1ee36d6aa220376537324d427741861e00138a.tar.gz elgg-0c1ee36d6aa220376537324d427741861e00138a.tar.bz2 | |
Fixes #4292 added a white list for ajax views
Diffstat (limited to 'engine/lib/elgglib.php')
| -rw-r--r-- | engine/lib/elgglib.php | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/engine/lib/elgglib.php b/engine/lib/elgglib.php index b044d230f..9035d95f2 100644 --- a/engine/lib/elgglib.php +++ b/engine/lib/elgglib.php @@ -1777,6 +1777,12 @@ function elgg_ajax_page_handler($page) { unset($page[0]); $view = implode('/', $page); + $allowed_views = elgg_get_config('allowed_ajax_views'); + if (!array_key_exists($view, $allowed_views)) { + header('HTTP/1.1 403 Forbidden'); + exit; + } + // pull out GET parameters through filter $vars = array(); foreach ($_GET as $name => $value) { |