arbitrary JSON file disclosure correction

The following securit issue has been fixed: https://github.com/sebsauvage/ZeroBin/issues/30
2013-10-31 22:53:22 +01:00 · 2013-10-31 22:53:22 +01:00 · c26c4a8bec
commit c26c4a8bec
parent d850f343e5
1 changed files with 1 additions and 1 deletions
--- a/lib/zerobin.php
+++ b/lib/zerobin.php
@ -315,7 +315,7 @@ class zerobin
        $dataid = $_SERVER['QUERY_STRING'];

        // Is this a valid paste identifier?
-        if (preg_match('/[a-f\d]{16}/', $dataid))
+        if (preg_match('\A[a-f\d]{16}\z', $dataid))
        {
            // Check that paste exists.
            if ($this->_model()->exists($dataid))