adam/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-08-06 08:43:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

fixes GHSA-rr39-mf4j-6594 prevent displaying RAW cookie content

Browse Source 
... and also factorize code checking the cookie.lang user input
This commit is contained in:
plegall
2026-05-01 16:58:09 +02:00
parent 33024bcc8d
commit 5277a7dee4
6 changed files with 47 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/functions_user.inc.php
+1 -19
View File
@@ -1051,25 +1051,7 @@ function log_user($user_id, $remember_me)
//New default login and register pages, if users changes languages and succesfully logs in
//we want to update the userpref language stored in a cookie
//TODO check value of cookie
if (isset($_COOKIE['lang']) and $user['language'] != $_COOKIE['lang'])
{
if (!array_key_exists($_COOKIE['lang'], get_languages()))
{
fatal_error('[Hacking attempt] the input parameter "'.$_COOKIE['lang'].'" is not valid');
}
single_update(
USER_INFOS_TABLE,
array('language' => $_COOKIE['lang']),
array('user_id' => $user_id)
);
// We unset the lang cookie, if user has changed their language using interface we don't want to keep setting it back
// to what was chosen using standard pages lang switch
setcookie("lang", "", time() - 3600);
}
load_cookie_language(false, true, true, $user_id);
if ($remember_me and $conf['authorize_remembering'])
{