iarv/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-03-28 17:42:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

fixes GHSA-wfmr-9hg8-jh3m protects pwg.activity.getList

Browse Source
This commit is contained in:
plegall
2026-02-24 17:14:35 +01:00
parent db2a156554
commit 3ab004f7f6
2 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
include/ws_functions/pwg.php
View File

@@ -454,8 +454,13 @@ function ws_getActivityList($param, &$service)
{
global $conf;
/* Test Lantency */
// sleep(1);
foreach (array('date_min', 'date_max') as $datefield)
{
if (!empty($param[$datefield]) and !is_valid_mysql_datetime($param[$datefield]))
{
return new PwgError(WS_ERR_INVALID_PARAM, 'Invalid '.$datefield);
}
}
$output_lines = array();
$current_key = '';
@@ -488,13 +493,13 @@ function ws_getActivityList($param, &$service)
if (isset($param['action']))
{
$where .= '
AND action = "'.$param['action'].'"';
AND action = "'.pwg_db_real_escape_string($param['action']).'"';
}
if (isset($param['object']))
{
$where .= '
AND object = "'.$param['object'].'"';
AND object = "'.pwg_db_real_escape_string($param['object']).'"';
}
if (!empty($param['date_min']))

10
ws.php
View File

@@ -86,8 +86,14 @@ function ws_addDefaultMethods( $arr )
array(
'page' => array('default'=>null,
'type'=>WS_TYPE_INT|WS_TYPE_POSITIVE),
'uid' => array('default'=>NULL,
'type'=>WS_TYPE_INT|WS_TYPE_POSITIVE),
'offset' => array('default'=>0,
'type'=>WS_TYPE_INT|WS_TYPE_POSITIVE),
'uid' => array('default'=>NULL, 'type'=>WS_TYPE_ID),
'date_min' => array('default'=>null),
'date_max' => array('default'=>null),
'id' => array('default'=>null, 'type'=>WS_TYPE_ID),
'object' => array('default'=>null),
'action' => array('default'=>null),
),
'Returns general informations.',
$ws_functions_root . 'pwg.php',