iarv/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-03-28 17:42:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

fixes GHSA-mgqc-3445-qghq checks standard date fields

Browse Source
This commit is contained in:
plegall
2026-02-17 18:54:20 +01:00
parent b26ca3e08a
commit 0f359f2af5
2 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
include/functions.inc.php
View File

@@ -3095,4 +3095,34 @@ function get_container_info()
}
}
/**
* Checks if the provided string is valid for a comparison test with a datetime field in MySQL
*
* Possible values : YYYY-MM-DD HH-MM-SS or YYYY-MM-DD
*
* @since 16.3
* @param string $datetime
* @return bool
*/
function is_valid_mysql_datetime(string $datetime)
{
// first we check the full date+time
$format = 'Y-m-d H:i:s';
$date = DateTime::createFromFormat($format, $datetime);
if ($date and $date->format($format) === $datetime)
{
return true;
}
// in case it fails, let's check with only date and no time
$format = 'Y-m-d';
$date = DateTime::createFromFormat($format, $datetime);
if ($date and $date->format($format) === $datetime)
{
return true;
}
return false;
}
?>

10
include/ws_functions.inc.php
View File

@@ -34,6 +34,16 @@ function ws_isInvokeAllowed($res, $methodName, $params)
*/
function ws_std_image_sql_filter( $params, $tbl_name='' )
{
foreach (array('f_min_date_available', 'f_max_date_available', 'f_min_date_created', 'f_max_date_created') as $datefield)
{
if (isset($params[$datefield]) and !is_valid_mysql_datetime($params[$datefield]))
{
global $service;
$service->sendResponse(new PwgError(WS_ERR_INVALID_PARAM, 'Invalid '.$datefield));
exit;
}
}
$clauses = array();
if ( is_numeric($params['f_min_rate']) )
{