lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: security

Browse Source
This commit is contained in:
Laurent Destailleur 2014-05-28 19:38:30 +02:00
parent baa573435b
commit 1f8c35b70b
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
htdocs/cashdesk/affContenu.php
View File

@ -54,16 +54,23 @@ print '</div>';
print '<div class="principal">'; print '<div class="principal">';
if ( $_GET['menu'] ) $page=GETPOST('menu','alpha');
if (in_array(
$page,
array(
'deconnexion',
'index','index_verif','facturation','facturation_verif','facturation_dhtml',
'validation','validation_ok','validation_ticket','validation_verif',
)
))
{ {
include $_GET['menu'].'.php'; include $page.'.php';
} }
else else
{ {
include 'facturation.php'; dol_print_error('','menu param '.$page.' is not inside allowed list');
} }
print '</div>'; print '</div>';
$_SESSION['serObjFacturation'] = serialize($obj_facturation); $_SESSION['serObjFacturation'] = serialize($obj_facturation);