API: sanitize username

https://github.com/marienfressinaud/FreshRSS/issues/13

1 files changed, 4 insertions, 1 deletions

diff --git a/p/api/greader.php b/p/api/greader.php
index 4122b12b9..291bcdf1f 100644
--- a/p/api/greader.php
+++ b/p/api/greader.php
@@ -124,7 +124,10 @@ function authorizationToUser() {
 	if ($headerAuth != '') {
 		$headerAuthX = explode('/', $headerAuth, 2);
 		if ((count($headerAuthX) === 2) && ($headerAuthX[1] === TEMP_AUTH)) {
-			return $headerAuthX[0];
+			$user = $headerAuthX[0];
+			if (ctype_alnum($user)) {
+				return $user;
+			}
 		}
 	}
 	return null;