validate input to import_xchan(), as we don't consistently check it prior to entering this function

1 files changed, 7 insertions, 0 deletions

diff --git a/include/zot.php b/include/zot.php
index 22f84b454..6d68d9087 100644
--- a/include/zot.php
+++ b/include/zot.php
@@ -445,6 +445,13 @@ function import_xchan($arr) {
 	$ret = array('success' => false);
 	$changed = false;
 
+	if(! (is_array($arr) && array_key_exists('success',$arr) && $arr['success'])) {
+		logger('import_xchan: invalid data packet: ' . print_r($arr,true));
+		$ret['message'] = t('Invalid data packet');
+		return $ret;
+	}
+
+
 	$xchan_hash = base64url_encode(hash('whirlpool',$arr['guid'] . $arr['guid_sig'], true));
 	$import_photos = false;