From 4b277193485c5dc5691330e20e72e19932a0bf60 Mon Sep 17 00:00:00 2001 From: Elliott Eggleston Date: Tue, 14 Nov 2017 00:26:30 -0500 Subject: [PATCH] Sanitize plugin ID for maintenance class name In case a plugin has e.g. a hyphen in its ID --- admin/include/plugins.class.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/admin/include/plugins.class.php b/admin/include/plugins.class.php index 12e7fd140..ed2c604d4 100644 --- a/admin/include/plugins.class.php +++ b/admin/include/plugins.class.php @@ -87,7 +87,8 @@ class plugins private static function build_maintain_class($plugin_id) { $file_to_include = PHPWG_PLUGINS_PATH . $plugin_id . '/maintain'; - $classname = $plugin_id.'_maintain'; + $sanitized = preg_replace('[^a-zA-Z0-9_\x7f-\xff]','_',$plugin_id); + $classname = $sanitized.'_maintain'; // 2.7 pattern (OO only) if (file_exists($file_to_include.'.class.php'))