From f57095e878fa0c3ecb6192bca1d19f9fef89508c Mon Sep 17 00:00:00 2001
From: Patrick Simianer <p@simianer.de>
Date: Wed, 8 Jun 2016 16:20:22 +0200
Subject: somewhat more secure

---
 inc/db.inc.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'inc/db.inc.php')

diff --git a/inc/db.inc.php b/inc/db.inc.php
index ed45f7b..7356076 100644
--- a/inc/db.inc.php
+++ b/inc/db.inc.php
@@ -1,7 +1,10 @@
 <?php
 
 $SESSION_DIR="/srv/postedit/sessions";
-$json = file_get_contents($SESSION_DIR."/".$_GET["key"]."/data.json");
+$key = $_GET["key"];
+if (preg_match('/^[a-z0-9]{4}$/', $key)) {
+  $json = file_get_contents($SESSION_DIR."/".$key."/data.json");
+}
 $db = json_decode($json);
 
 ?>
-- 
cgit v1.2.3