iarv/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-03-28 17:42:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

fixes GHSA-wfmr-9hg8-jh3m protects pwg.activity.getList

Browse Source
This commit is contained in:
plegall
2026-02-24 17:14:35 +01:00
parent db2a156554
commit 3ab004f7f6
2 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
include/ws_functions/pwg.php
View File

@@ -454,8 +454,13 @@ function ws_getActivityList($param, &$service)
{ {
global $conf; global $conf;
/* Test Lantency */ foreach (array('date_min', 'date_max') as $datefield)
// sleep(1); {
if (!empty($param[$datefield]) and !is_valid_mysql_datetime($param[$datefield]))
{
return new PwgError(WS_ERR_INVALID_PARAM, 'Invalid '.$datefield);
}
}
$output_lines = array(); $output_lines = array();
$current_key = ''; $current_key = '';
@@ -488,13 +493,13 @@ function ws_getActivityList($param, &$service)
if (isset($param['action'])) if (isset($param['action']))
{ {
$where .= ' $where .= '
AND action = "'.$param['action'].'"'; AND action = "'.pwg_db_real_escape_string($param['action']).'"';
} }
if (isset($param['object'])) if (isset($param['object']))
{ {
$where .= ' $where .= '
AND object = "'.$param['object'].'"'; AND object = "'.pwg_db_real_escape_string($param['object']).'"';
} }
if (!empty($param['date_min'])) if (!empty($param['date_min']))

10
ws.php
View File

@@ -86,8 +86,14 @@ function ws_addDefaultMethods( $arr )
array( array(
'page' => array('default'=>null, 'page' => array('default'=>null,
'type'=>WS_TYPE_INT|WS_TYPE_POSITIVE), 'type'=>WS_TYPE_INT|WS_TYPE_POSITIVE),
'uid' => array('default'=>NULL, 'offset' => array('default'=>0,
'type'=>WS_TYPE_INT|WS_TYPE_POSITIVE), 'type'=>WS_TYPE_INT|WS_TYPE_POSITIVE),
'uid' => array('default'=>NULL, 'type'=>WS_TYPE_ID),
'date_min' => array('default'=>null),
'date_max' => array('default'=>null),
'id' => array('default'=>null, 'type'=>WS_TYPE_ID),
'object' => array('default'=>null),
'action' => array('default'=>null),
), ),
'Returns general informations.', 'Returns general informations.',
$ws_functions_root . 'pwg.php', $ws_functions_root . 'pwg.php',