openrat-cms

commit 74438549e8efe324eda6b35badda4cc9bcd60643
parent c0d0c7f5e0908c4ef0028601a92018eccb3e784c
Author: dankert <devnull@localhost>
Date:   Fri, 25 Sep 2009 01:03:37 +0200

Für Requestvariablen per default die Zeichen \"@?=&\" zulassen.

Diffstat:
actionClasses/Action.class.php
 | 
3
++-

1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/actionClasses/Action.class.php b/actionClasses/Action.class.php
@@ -152,7 +152,8 @@ class Action
 				$value   = $REQ[ $varName ];
 				$allowed = ' ';
 				for ($i =  40; $i <=  59; $i++) $allowed .= chr($i);  // Zahlen 
-				for ($i =  65; $i <=  93; $i++) $allowed .= chr($i);  // ABC
+				                                $allowed .= '@?&=';
+				for ($i =  63; $i <=  93; $i++) $allowed .= chr($i);  // ?@ABC
 				                                $allowed .= chr(95);  // _
 				for ($i =  97; $i <= 122; $i++) $allowed .= chr($i);  // abc
 				for ($i = 192; $i <= 255; $i++) $allowed .= chr($i);  // Sonderzeichen