18e4b86199
(cp 69345c0) fixes #847 , CVE-2018-5692 protect a few user input variables
2018-07-11 11:24:59 +02:00
0ec289769e
(cp 23fa4c1) fixes #871 , CVE-2018-7722 strip tags on methods pwg.categories.add, pwg.categories.setInfo, pwg.images.setInfo
...
Adding pwg_token would be a better solution but would break remote applications (like the iOS app)
2018-07-06 18:31:58 +02:00
55a9754b11
(cp bef0901) fixes #872 , CVE-2018-7724, protect photo admin page from CSRF
2018-07-06 14:39:50 +02:00
c6d6a5ec0a
(cp 06f4252) fixes #258 , batch manager, check the session category still exists
2018-07-06 11:52:52 +02:00
90243ddb0c
(cp 65ac272) Include pwg_token in user list POST request ( Fixes #748 ) ( #866 )
...
* user list: set pwg_token in POST data to user_list_backend.php
The POST data for the user data table request was empty, which could
cause user data retrieval to error out with HTTP 403 due to missing
the authentication token.
* user_list_backend: fix uninitialized variables
If iSortCol_0, sEcho, or sSearch are unset in the HTTP request, it
could cause variables to be uninitialized, potentially causing error
messages to be included in the HTTP response. These error messages,
if present, can prevent the JSON response from being parsed.
* user list: delete unnecessary quotes
Javascript object key names don't generally need to be quoted.
Remove some quotes that were introduced by a recent change that added
a body to the AJAX POST request to retrieve the user list.
2018-07-06 10:52:47 +02:00
49c1d7e004
(cp 7e41e21) Fix issue #844
2018-07-05 15:53:43 +02:00
4f42239aec
(cp 7511881) fixes #887 , $selection is never set on PHP side, no need to use it in template
...
... and it makes the template compatible with PHP 7.2
2018-07-04 17:12:52 +02:00
ebdacd3e83
fixes #853 , less strict check on user input "selectAction" for tag manager
...
... for compatibility with plugin Colored Tags (typetags) and maybe other in the future.
2018-03-23 10:01:06 +01:00
a38ff3bac0
(cp 8a57d77) fixes #596 , compatibility with PHP 7.1
2018-02-27 12:02:45 +01:00
f4be39d658
next version is 2.9.3
2018-02-22 15:04:28 +01:00
f178869f9b
cherry-pick 27 commits from translation
...
* 2c45ca53b0f56e60b44781c02e03633cd564e65e00fc4531a31f8a126e36be5457a93d4e5ee3fc15ff12341e1b05c758f610a685c739a9209cab06190934a4b1cd6cdd4a0f4ecd3a137b44fda24991c9692f515ae211140577a25e356c3eb2c2c443
2018-02-22 14:51:45 +01:00
aee8fa1f8d
(cp 02275fe) fixes #839 , check input parameters on admin/tags.php
2018-02-22 14:18:59 +01:00
6d2f2a1d0d
(cp 63932b9) fixes #735 , add API method pwg.users.getAuthKey
2018-02-22 14:17:44 +01:00
072ae305f8
(cp b6d61a7) fixes #838 , tells PHP how many photos were deleted in Batch Manager
2018-02-08 13:05:11 +01:00
91ef7909a5
(cp 9671454) fixes #826 , check input parameter order_by in configuration
2017-12-18 17:09:56 +01:00
f7c8e0a947
(cp 9028c75) fixes #825 , check user input on Batch Manager, unit mode, to prevent SQL injection
2017-12-18 16:45:56 +01:00
c3b4c6f7f0
(cp 77f02bf) fixes #822 , add token on configuration page to prevent CSRF
2017-12-18 15:16:13 +01:00
53d62e0c14
(cp 9e29db0) fixes #824 more generic code to get current script directory (working both on Linux and MacOSX)
2017-12-18 14:30:10 +01:00
33a03e9afb
(cp 1da9d6a) fixes #823 add input user check to avoid SQLi on users list
2017-12-18 14:06:28 +01:00
045d98ab00
cherry-pick 11 commits from translation
...
* daccbf5b12c138b64c5f12e5fad86aaf8509ffefd08480afa84c9eaf00b747cafddae50cb7861167a462
2017-10-05 18:06:41 +02:00
2767587056
next version is 2.9.2
2017-10-05 16:00:42 +02:00
27de5c0345
(cp ee4aae7) Fixes #767 - Return a 500 HTTP status when a file upload error occurs. ( #768 )
2017-10-05 15:40:21 +02:00
f57c81babd
(cp 9775889) fixes #789 , add url param hide_redirect_error
2017-10-04 10:37:21 +02:00
8d6fee190d
(cp 164b595) fixes #777 WS categories getImages, TotalCount for correct pagination builder
2017-09-30 17:09:03 +02:00
9cd6b7c90d
(cp a335d70) fixes 787, check URL parameter "action" to avoid error messages
2017-09-28 15:04:02 +02:00
6530720d51
(cp 943ab9d) Issue/747 php notice when changing admin page theme ( #774 )
...
* Fixes#747 Only variables should be passed by reference
* Fixes syntax
2017-09-19 11:25:53 +02:00
e1817474ea
(cp c9ab538) Fixs issue #760 date_creation not refreshed when changing it from picture_modify ( #763 )
2017-09-18 17:50:23 +02:00
75e1be46b1
(cp b585f5b) Removing Deprecated error message for PHP 7 ( #764 )
2017-09-18 17:22:43 +02:00
410edc8de1
(cp 011b12c) fixes #751 , missing DROP statements at install
2017-09-05 13:24:49 +02:00
62afa8b1ff
(cp 08cce48) Fixes #755 Never thow '0000-00-00 00:00:00' as value but Null instead
...
only for exif ; iptc is ok
2017-09-05 13:22:01 +02:00
183de75e7e
(cp 2c07301) Fixing issue #731 ( #754 )
...
* Fixing issue #731 , if NB_PHOTOS is upper than 1000 display it
* Fixs issue #731 now number of picture between 1000 and 1999 are displayed
* Fixs formatting
2017-09-04 14:27:59 +02:00
0f2c9a805f
(cp 028c4ee) fixes #739 , make sure keys are reset in the "uniquified" array
...
... for a regular search, when different set of photos matches the search.
2017-07-25 18:28:23 +02:00
524ae64be4
(cp a3cf80c) fixes #732 , avoid conflict with PHP function "transliterate"
2017-07-13 11:30:54 +02:00
fb4006bda6
(cp f520f82) fixes #726 , add trigger in create_virtual_category
2017-07-03 15:56:54 +02:00
5c3e24c02f
(cp 30e8bab) pwg_token left for cat_options pages
...
solving https://github.com/Piwigo/Piwigo/issues/721
2017-07-03 15:12:36 +02:00
a9645181c6
(cp 3dd6812) check input parameter for cat_options pages
...
solving https://github.com/Piwigo/Piwigo/issues/724
2017-07-03 15:12:20 +02:00
7f8bff3d95
(cp 03a8329) adding pwg_token on permalink & cat_options
...
and therefor solving issue:721
2017-07-03 15:12:02 +02:00
be9ec05596
(cp 4d031c9) fixes #725 , protect pwg.images.setInfo from HTML
2017-07-03 13:55:19 +02:00
0dc3810f0d
(cp d542de7) fixes #713 , use the default language to send email
...
and not only to build the email body message
2017-06-21 11:46:07 +02:00
eff137091e
(cp fffd351) fixes #710 , avoid using get_gallery_home_url()
...
because it may be different from get_absolute_root_url() if you have a $conf['gallery_url']
2017-06-15 23:13:29 +02:00
127618e589
cherry-pick 33 commits from translation 928773b to 7c5f1f3
...
git log --reverse --oneline translation ^master --pretty=format:"git cherry-pick --no-commit %H" 706988e..7c5f1f3 | bash
* 7c5f1f3ac1fb9e04430ff9abfca2c37ca77e5af8c7e72634c1c5a180061c210b2459ce73dd934fb862245f4b3242acd12603d251ceb796c015d72db564508c8dc98708111639ae19b372157c13ac923267b946a2c3cf827bea4b3f224983d67a8eebd21835a6705c6cd35f6bf13c51d32a4a4cd928773b
2017-06-15 13:44:28 +02:00
c6c6305302
(cp 346f5c3) fixes #707 , hide decimal for "158.0 pages seen"
2017-06-14 19:44:28 +02:00
5d281a4ff5
(cp bbb9c5e) issue #706 , force redirection within Piwigo
2017-06-14 19:04:17 +02:00
9539abeb59
(cp 4b9b785) issue #706 , check the redirect is within Piwigo
2017-06-14 19:03:19 +02:00
42920897ce
(cp 6ce14fc) fixes #705 , check user_list_backend.php input params
2017-06-13 12:32:49 +02:00
10700c8739
next version is 2.9.1
2017-06-12 14:37:44 +02:00
61a25ceb3b
(cp e0b7c1d) fixes #701 , use the appropriate site_id instead of 1
...
When coming from the album edit page with the action link to synchronization
2017-06-12 14:32:14 +02:00
6692f5efc3
(cp 4581f3e) fixes #693 , pclzip compatibility with PHP 7.1
2017-06-12 13:51:26 +02:00
1b22d08a80
(cp 4310fe7) fixes #667 , check $_GET['page'] to avoid XSS
...
This can be an issue only on Internet Explorer
2017-06-12 11:38:00 +02:00
c1e8f6f758
(cp 3ae62ce) fixes #699 , make sure $_GET['tab'] does not include unexpected chars
2017-06-02 10:12:00 +02:00
plegall