adam/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-07-06 01:42:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

merge r30948 from trunk to branch 2.7

Browse Source 
bug 3200 fixed: add input checks on admin history


git-svn-id: http://piwigo.org/svn/branches/2.7@30949 68402e56-0260-453c-a942-63ccdbb3a9ee
This commit is contained in:
plegall
2015-02-12 14:30:14 +00:00
parent 11f530c514
commit f07a61c105
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/history.php
+11 -3
View File
@@ -75,11 +75,15 @@ if (isset($_POST['submit']))
// dates
if (!empty($_POST['start']))
{
$_POST['start'] = trim($_POST['start']);
check_input_parameter('start', $_POST, false, '/^\d{4}-\d{2}-\d{2}$/');
$search['fields']['date-after'] = $_POST['start'];
}
if (!empty($_POST['end']))
{
$_POST['end'] = trim($_POST['end']);
check_input_parameter('end', $_POST, false, '/^\d{4}-\d{2}-\d{2}$/');
$search['fields']['date-before'] = $_POST['end'];
}
@@ -89,10 +93,11 @@ if (isset($_POST['submit']))
}
else
{
check_input_parameter('types', $_POST, true, '/^('.implode('|', $types).')$/');
$search['fields']['types'] = $_POST['types'];
}
$search['fields']['user'] = $_POST['user'];
$search['fields']['user'] = intval($_POST['user']);
if (!empty($_POST['image_id']))
{
@@ -117,6 +122,8 @@ if (isset($_POST['submit']))
);
}
check_input_parameter('display_thumbnail', $_POST, false, '/^('.implode('|', array_keys($display_thumbnails)).')$/');
$search['fields']['display_thumbnail'] = $_POST['display_thumbnail'];
// Display choise are also save to one cookie
if (!empty($_POST['display_thumbnail'])
@@ -142,8 +149,9 @@ if (isset($_POST['submit']))
INSERT INTO '.SEARCH_TABLE.'
(rules)
VALUES
(\''.serialize($search).'\')
(\''.pwg_db_real_escape_string(serialize($search)).'\')
;';
pwg_query($query);
$search_id = pwg_db_insert_id(SEARCH_TABLE);
@@ -618,4 +626,4 @@ $template->assign('display_thumbnail_selected', $form['display_thumbnail']);
// +-----------------------------------------------------------------------+
$template->assign_var_from_handle('ADMIN_CONTENT', 'history');
?>
?>