From f4ebb0664e1855b558e953eaee9c9e7da9568452 Mon Sep 17 00:00:00 2001 From: Dany De Bontridder Date: Sun, 25 Oct 2015 17:58:47 +0100 Subject: [PATCH] Reinforce and Protect ajax --- include/ajax/ajax_remove_submenu.php | 1 + 1 file changed, 1 insertion(+) diff --git a/include/ajax/ajax_remove_submenu.php b/include/ajax/ajax_remove_submenu.php index 913f997b4..92473017b 100644 --- a/include/ajax/ajax_remove_submenu.php +++ b/include/ajax/ajax_remove_submenu.php @@ -26,5 +26,6 @@ if ( ! defined ('ALLOWED') ) die('Appel direct ne sont pas permis'); if ($g_user->check_module('CFGPRO')==0) die(); $p_profile_menu_id=HtmlInput::default_value_get('p_profile_menu_id', 0); +if ( $p_profile_menu_id == 0 ||isNumber($p_profile_menu_id)==0) throw new Exception(_('Donnée invalide')); $cn->exec_sql('delete from profile_menu where pm_id = $1 or pm_id_dep=$1',array($p_profile_menu_id)) ?> \ No newline at end of file