adam/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-08-09 02:03:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

(cp 0649ad3) fixes #1924 protect API user input from SQL injections

Browse Source
This commit is contained in:
plegall
2023-05-29 12:26:51 +02:00
parent 7c1a1afc2d
commit 249bb6c932
4 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/constants.php
+1
View File
@@ -37,6 +37,7 @@ define('ACTIVITY_SYSTEM_THEME', 3);
// Sanity checks
define('PATTERN_ID', '/^\d+$/');
define('PATTERN_ORDER', '/^(rand(om)?|[a-z_]+(\s+(asc|desc))?)(\s*,\s*(rand(om)?|[a-z_]+(\s+(asc|desc))?))*$/i');
// Table names
if (!defined('CATEGORIES_TABLE'))
include/ws_functions/pwg.groups.php
+5
View File
@@ -15,6 +15,11 @@
*/
function ws_groups_getList($params, &$service)
{
if (!preg_match(PATTERN_ORDER, $params['order']))
{
return new PwgError(WS_ERR_INVALID_PARAM, 'Invalid input parameter order');
}
$where_clauses = array('1=1');
if (!empty($params['name']))
include/ws_functions/pwg.users.php
+5
View File
@@ -29,6 +29,11 @@ function ws_users_getList($params, &$service)
{
global $conf;
if (!preg_match(PATTERN_ORDER, $params['order']))
{
return new PwgError(WS_ERR_INVALID_PARAM, 'Invalid input parameter order');
}
$where_clauses = array('1=1');
if (!empty($params['user_id']))