adam/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-08-12 03:33:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

fixes #1011 add user input checks (and pwg_token) to avoid SQL injection (and CSRF)

Browse Source
This commit is contained in:
plegall
2019-08-12 16:45:21 +02:00
parent 91349065ea
commit 7234d0108e
4 changed files with 26 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/user_perm.php
+9
View File
@@ -18,6 +18,13 @@ include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
// +-----------------------------------------------------------------------+
check_status(ACCESS_ADMINISTRATOR);
if (!empty($_POST))
{
check_pwg_token();
check_input_parameter('cat_true', $_POST, true, PATTERN_ID);
check_input_parameter('cat_false', $_POST, true, PATTERN_ID);
}
// +-----------------------------------------------------------------------+
// | variables init |
// +-----------------------------------------------------------------------+
@@ -158,6 +165,8 @@ $query_false.= '
;';
display_select_cat_wrapper($query_false,array(),'category_option_false');
$template->assign('PWG_TOKEN', get_pwg_token());
// +-----------------------------------------------------------------------+
// | sending html code |
// +-----------------------------------------------------------------------+