fixes GHSA-hq29-8hhx-5jwc [search] check input parameter ratings

include/functions_search.inc.php

@@ -637,7 +637,7 @@ SELECT
       }
       else
       {
-        $filter_clauses[] = '(rating_score >= '.(intval($r)-1).' AND rating_score < '.$r.')';
+        $filter_clauses[] = '(rating_score >= '.(intval($r)-1).' AND rating_score < '.intval($r).')';
       }
     }
 

include/ws_functions/pwg.images.php

@@ -1039,6 +1039,14 @@ function ws_images_filteredSearch_create($params, $service)
 
   if ($conf['rate'] and isset($params['ratings']))
   {
+    foreach ($params['ratings'] as $rate)
+    {
+      if (!preg_match('/^\d+$/i', $rate))
+      {
+        return new PwgError(WS_ERR_INVALID_PARAM, 'Invalid parameter ratings');
+      }
+    }
+
     $search['fields']['ratings'] = $params['ratings'];
   }