2 files changed, 7 insertions, 1 deletions

diff --git a/inc/functions.inc.php b/inc/functions.inc.php
index 376b6e1..1c12c2f 100644
--- a/inc/functions.inc.php
+++ b/inc/functions.inc.php
@@ -1,8 +1,11 @@
 <?php
 
+require_once 'conf/common.inc.php';
+
 # global functions
 
 function GET($index = NULL, $value = NULL) {
+        global $CONFIG;
         # parse all values from $_GET when no index is given
         if ($index === NULL) {
                 $arr = array();
@@ -40,6 +43,9 @@ function GET($index = NULL, $value = NULL) {
                         }
                 break;
                 case 'p': # plugin
+                        if ((!in_array($value, $CONFIG['allowed'])) && (!in_array($value, $CONFIG['overview']))) {
+                                return NULL;
+                        }
                 case 'c': # category
                 case 't': # type
                         if (!preg_match('/^\w+$/u', $value)) {
diff --git a/inc/html.inc.php b/inc/html.inc.php
index deebdc0..bc38b24 100644
--- a/inc/html.inc.php
+++ b/inc/html.inc.php
@@ -181,7 +181,7 @@ function plugins_list($host, $selected_plugins = array()) {
 
         # other plugins
         foreach($plugins as $plugin) {
-                if (!in_array($plugin, $CONFIG['overview'])) {
+                if (in_array($plugin, $CONFIG['allowed'])) {
                         printf("<li><a %shref=\"%shost.php?h=%s&amp;p=%s\">%s</a></li>\n",
                                 selected_plugin($plugin, $selected_plugins),
                                 htmlentities($CONFIG['weburl']),