adam/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-07-05 09:22:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

(cp 0649ad3) fixes #1924 protect API user input from SQL injections

Browse Source
This commit is contained in:
plegall
2023-05-29 12:26:51 +02:00
parent 7c1a1afc2d
commit 249bb6c932
4 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/ws_functions/pwg.groups.php
+5
View File
@@ -15,6 +15,11 @@
*/
function ws_groups_getList($params, &$service)
{
if (!preg_match(PATTERN_ORDER, $params['order']))
{
return new PwgError(WS_ERR_INVALID_PARAM, 'Invalid input parameter order');
}
$where_clauses = array('1=1');
if (!empty($params['name']))
include/ws_functions/pwg.users.php
+5
View File
@@ -29,6 +29,11 @@ function ws_users_getList($params, &$service)
{
global $conf;
if (!preg_match(PATTERN_ORDER, $params['order']))
{
return new PwgError(WS_ERR_INVALID_PARAM, 'Invalid input parameter order');
}
$where_clauses = array('1=1');
if (!empty($params['user_id']))