adam/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-07-20 08:33:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

- security fix : when conf['question_mark_in_urls']=true , $_SERVER['PATH_INFO'] was not sanitized against sql injection

Browse Source 
- mysql errors are now dumped using trigger_error instead of echo and die -> allow admins to see later on if someone tries funny stuff

git-svn-id: http://piwigo.org/svn/branches/branch-1_7@2483 68402e56-0260-453c-a942-63ccdbb3a9ee
This commit is contained in:
rvelices
2008-08-23 01:15:33 +00:00
parent f645fc1419
commit 7550df3915
2 changed files with 27 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/common.inc.php
+6 -4
View File
@@ -102,6 +102,10 @@ if( !get_magic_quotes_gpc() )
@reset($_COOKIE);
}
}
if ( !empty($_SERVER["PATH_INFO"]) )
{
$_SERVER["PATH_INFO"] = addslashes($_SERVER["PATH_INFO"]);
}
//
// Define some basic configuration arrays this also prevents malicious
@@ -141,10 +145,8 @@ include(PHPWG_ROOT_PATH . 'include/functions.inc.php');
include(PHPWG_ROOT_PATH . 'include/template.php');
// Database connection
mysql_connect( $cfgHote, $cfgUser, $cfgPassword )
or die ( "Could not connect to database server" );
mysql_select_db( $cfgBase )
or die ( "Could not connect to database" );
@mysql_connect( $cfgHote, $cfgUser, $cfgPassword ) or my_error( 'mysql_connect', true );
@mysql_select_db( $cfgBase ) or my_error( 'mysql_select_db', true );
//
// Setup gallery wide options, if this fails then we output a CRITICAL_ERROR