adam/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-08-07 01:03:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

fixes GHSA-wfmr-9hg8-jh3m protects pwg.activity.getList

Browse Source
This commit is contained in:
plegall
2026-02-24 17:14:35 +01:00
parent db2a156554
commit 3ab004f7f6
2 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/ws_functions/pwg.php
+9 -4
View File
@@ -454,8 +454,13 @@ function ws_getActivityList($param, &$service)
{
global $conf;
/* Test Lantency */
// sleep(1);
foreach (array('date_min', 'date_max') as $datefield)
{
if (!empty($param[$datefield]) and !is_valid_mysql_datetime($param[$datefield]))
{
return new PwgError(WS_ERR_INVALID_PARAM, 'Invalid '.$datefield);
}
}
$output_lines = array();
$current_key = '';
@@ -488,13 +493,13 @@ function ws_getActivityList($param, &$service)
if (isset($param['action']))
{
$where .= '
AND action = "'.$param['action'].'"';
AND action = "'.pwg_db_real_escape_string($param['action']).'"';
}
if (isset($param['object']))
{
$where .= '
AND object = "'.$param['object'].'"';
AND object = "'.pwg_db_real_escape_string($param['object']).'"';
}
if (!empty($param['date_min']))