adam/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-08-07 01:03:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

fixes GHSA-rr39-mf4j-6594 prevent displaying RAW cookie content

Browse Source 
... and also factorize code checking the cookie.lang user input
This commit is contained in:
plegall
2026-05-01 16:58:09 +02:00
parent 33024bcc8d
commit 5277a7dee4
6 changed files with 47 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
profile.php
+1 -21
View File
@@ -78,27 +78,7 @@ SELECT '.implode(',', $fields).'
include(PHPWG_ROOT_PATH.'include/page_header.php');
//Load language if cookie is set from login/register/password pages
if (isset($_COOKIE['lang']) and $user['language'] != $_COOKIE['lang'])
{
if (!array_key_exists($_COOKIE['lang'], get_languages()))
{
fatal_error('[Hacking attempt] the input parameter "'.$_COOKIE['lang'].'" is not valid');
}
$user['language'] = $_COOKIE['lang'];
single_update(
USER_INFOS_TABLE,
array(
'language' => $_COOKIE['lang']
),
array(
'user_id' => $user['id']
)
);
load_language('common.lang', '', array('language'=>$user['language']));
}
load_cookie_language(true, true);
//Get list of languages
foreach (get_languages() as $language_code => $language_name)