Fix: Ditto - sql error of &documents parameter

ref: #1089
modxcms · Dec 10, 2016 · 21fabe6 · 21fabe6
1 parent e39b9d6
commit 21fabe6
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/assets/snippets/ditto/classes/ditto.class.inc.php b/assets/snippets/ditto/classes/ditto.class.inc.php
@@ -592,6 +592,7 @@ function determineIDs($IDs, $IDType, $TVs, $orderBy, $depth, $showPublishedOnly,
 				$documentIDs = $this->getChildIDs($IDs, $depth);
 			break;
 			case "documents":
+				if(!preg_match('@^[0-9, ]*$@',$IDs)) exit(sprintf('Illegal value of &amp;documents: %s', $IDs));
 				$documentIDs = explode(",",$IDs);
 			break;
 		}