iarv/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-05-18 15:26:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

fixes GHSA-6wj3-7fhw-gfpm upgrade/install: make sure user input is sanitized

Browse Source
This commit is contained in:
plegall
2026-05-03 12:03:43 +02:00
parent 5277a7dee4
commit 2cfa7a3d19
2 changed files with 13 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/include/functions_upgrade.php
+1 -1
View File
@@ -212,7 +212,7 @@ SELECT status
$username = $_POST['username']; $username = $_POST['username'];
$password = $_POST['password']; $password = $_POST['password'];
if(function_exists('get_magic_quotes_gpc') && !@get_magic_quotes_gpc() ) if (!function_exists('get_magic_quotes_gpc') or !@get_magic_quotes_gpc())
{ {
$username = pwg_db_real_escape_string($username); $username = pwg_db_real_escape_string($username);
} }
install.php
+12 -58
View File
@@ -9,71 +9,25 @@
//----------------------------------------------------------- include //----------------------------------------------------------- include
define('PHPWG_ROOT_PATH','./'); define('PHPWG_ROOT_PATH','./');
// @set_magic_quotes_runtime(0); // Disable magic_quotes_runtime // copied from include/common.inc.php
// if (!function_exists('get_magic_quotes_gpc') or !@get_magic_quotes_gpc() )
// addslashes to vars if magic_quotes_gpc is off this is a security
// precaution to prevent someone trying to break out of a SQL statement.
//
if(function_exists('get_magic_quotes_gpc') && !@get_magic_quotes_gpc() )
{ {
if( is_array($_POST) ) function sanitize_mysql_kv(&$v, $k)
{ {
foreach($_POST as $k => $v) $v = addslashes($v);
{
if( is_array($_POST[$k]) )
{
foreach($_POST[$k] as $k2 => $v2)
{
$_POST[$k][$k2] = addslashes($v2);
}
@reset($_POST[$k]);
}
else
{
$_POST[$k] = addslashes($v);
}
}
@reset($_POST);
} }
if( is_array($_GET) ) if( is_array( $_GET ) )
{ {
foreach($_GET as $k => $v ) array_walk_recursive( $_GET, 'sanitize_mysql_kv' );
{
if( is_array($_GET[$k]) )
{
foreach($_GET[$k] as $k2 => $v2)
{
$_GET[$k][$k2] = addslashes($v2);
}
@reset($_GET[$k]);
}
else
{
$_GET[$k] = addslashes($v);
}
}
@reset($_GET);
} }
if( is_array( $_POST ) )
if( is_array($_COOKIE) )
{ {
foreach($_COOKIE as $k => $v) array_walk_recursive( $_POST, 'sanitize_mysql_kv' );
{ }
if( is_array($_COOKIE[$k]) ) if( is_array( $_COOKIE ) )
{ {
foreach($_COOKIE[$k] as $k2 => $v2) array_walk_recursive( $_COOKIE, 'sanitize_mysql_kv' );
{
$_COOKIE[$k][$k2] = addslashes($v2);
}
@reset($_COOKIE[$k]);
}
else
{
$_COOKIE[$k] = addslashes($v);
}
}
@reset($_COOKIE);
} }
} }