Changeset 290 for trunk/gallery.php

Timestamp:

12/19/05 11:45:01 (3 years ago)

Author:

anti

Message:

and a few more security fixes

Files:

• trunk/gallery.php (modified) (1 diff)

trunk/gallery.php

@@ -45 +45 @@
 
 // use plogger specific variables to avoid name clashes if Plogger is embedded
+
+
+
 $GLOBALS['plogger_level'] = isset($_GET["level"]) ? $_GET["level"] : '';
-$GLOBALS['plogger_id'] = isset($_GET["id"]) ? $_GET["id"] : 0;
+$GLOBALS['plogger_id'] = isset($_GET["id"]) ? intval($_GET["id"]) : 0;
 $GLOBALS['plogger_mode'] = isset($_GET["mode"]) ? $_GET["mode"] : '';
+
+$allowed_levels = array('collections','collection','album','picture','search');
+if (!in_array($GLOBALS['plogger_level'],$allowed_levels)) {
+        $GLOBALS['plogger_level'] = 'collections';
+};