diff options
| author | Cash Costello <cash.costello@gmail.com> | 2011-07-04 09:15:11 -0700 |
|---|---|---|
| committer | Cash Costello <cash.costello@gmail.com> | 2011-07-04 09:15:11 -0700 |
| commit | 440c94c74f929344c5b755e2607c8426d4de08b3 (patch) | |
| tree | aa042845b8e241fdba5b9bd8ebeab66631437b4a /engine/lib/river.php | |
| parent | de111da23258cd2b513c8f4ab84712ee50272b23 (diff) | |
| parent | 3beedd84a7dbcf7a17a75248473302320653d231 (diff) | |
| download | elgg-440c94c74f929344c5b755e2607c8426d4de08b3.tar.gz elgg-440c94c74f929344c5b755e2607c8426d4de08b3.tar.bz2 | |
Merge pull request #53 from cash/reflected_xss_fixes
Fixes #3544 Reflected xss fixes
Diffstat (limited to 'engine/lib/river.php')
| -rw-r--r-- | engine/lib/river.php | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/engine/lib/river.php b/engine/lib/river.php index 36dde7f05..1a2be1e50 100644 --- a/engine/lib/river.php +++ b/engine/lib/river.php @@ -589,10 +589,13 @@ function elgg_river_page_handler($page) { elgg_set_page_owner_guid(elgg_get_logged_in_user_guid()); + // make a URL segment available in page handler script $page_type = elgg_extract(0, $page, 'all'); + $page_type = preg_replace('[\W]', '', $page_type); if ($page_type == 'owner') { $page_type = 'mine'; } + set_input('page_type', $page_type); // content filter code here $entity_type = ''; |