Moved forms folder to includes and added some safety checks for non-admin users

This commit is contained in:
laf
2015-08-10 15:13:27 +00:00
parent 15a338061d
commit 261cd020f3
39 changed files with 87 additions and 2 deletions

View File

@@ -28,7 +28,7 @@ if (!$_SESSION['authenticated']) {
}
if (preg_match('/^[a-zA-Z0-9\-]+$/', $_POST['type']) == 1) {
if (file_exists('forms/'.$_POST['type'].'.inc.php')) {
include_once 'forms/'.$_POST['type'].'.inc.php';
if (file_exists('includes/forms/'.$_POST['type'].'.inc.php')) {
include_once 'includes/forms/'.$_POST['type'].'.inc.php';
}
}