added validation for themename - see SC #101

2005-07-05 07:49:30 +00:00
parent 6049058f5e
commit 7a6b6d5f19
1 changed files with 2 additions and 0 deletions
@@ -2013,6 +2013,8 @@ function style_sheet_setup($lastmodified=0, $lifetime=300, $themename='', $force

    if (empty($themename)) {
        $themename = current_theme();  // So we have something.  Normally not needed.
+    } else {
+        $themename = clean_param($themename, PARAM_SAFEDIR);
    }

    if (!empty($forceconfig)) {        // Page wants to use the config from this theme instead