Browse Source

[svn r21870] FS#2867 - The FCKEditor, the initialization script: Adding security-related checks.

Ivan Tcholakov 15 years ago
parent
commit
6b00e081c6
1 changed files with 5 additions and 3 deletions
  1. 5 3
      main/inc/lib/fckeditor/fckeditor.php

+ 5 - 3
main/inc/lib/fckeditor/fckeditor.php

@@ -421,9 +421,11 @@ class FCKeditor
 			require api_get_path(LIBRARY_PATH).'fckeditor/myconfig.php';
 		}
 		if (!isset($config['ToolbarSets'][$this->ToolbarSet])) {
-			@include api_get_path(LIBRARY_PATH).'fckeditor/'.$config['ToolbarSets']['Directory'].'/'.self::camel_case_to_underscore($this->ToolbarSet).'.php';
-			if (!isset($config['ToolbarSets'][$this->ToolbarSet])) {
-				$this->ToolbarSet = 'Default';
+			if (preg_match('/[a-zA-Z_]+/', $config['ToolbarSets']['Directory']) && preg_match('/[a-zA-Z_]+/', $this->ToolbarSet)) { // Checks for increased security.
+				@include api_get_path(LIBRARY_PATH).'fckeditor/'.$config['ToolbarSets']['Directory'].'/'.self::camel_case_to_underscore($this->ToolbarSet).'.php';
+				if (!isset($config['ToolbarSets'][$this->ToolbarSet])) {
+					$this->ToolbarSet = 'Default';
+				}
 			}
 		}
 		return $config;