Changeset 2755

Timestamp:

Oct 16, 2008, 2:09:53 AM (16 years ago)

Author:

rvelices

Message:

• fix vulnerability ​http://www.milw0rm.com/exploits/6755

Location:

branches/2.0

Files:

• comments.php (modified) (2 diffs)
• plugins/event_tracer/event_list.php (modified) (3 diffs)

branches/2.0/comments.php

@@ -66 +66 @@
 $page['sort_by'] = 'date';
 // if the form was submitted, it overloads default behaviour
-if (isset($_GET['sort_by']))
+if (isset($_GET['sort_by']) and isset($sort_by[$_GET['sort_by']]) )
 {
   $page['sort_by'] = $_GET['sort_by'];
@@ -75 +75 @@
 $page['sort_order'] = 'DESC';
 // if the form was submitted, it overloads default behaviour
-if (isset($_GET['sort_order']))
+if (isset($_GET['sort_order']) and isset($sort_order[$_GET['sort_order']]))
 {
   $page['sort_order'] = $_GET['sort_order'];

branches/2.0/plugins/event_tracer/event_list.php

@@ -17 +17 @@
           {
             $files = array_merge($files, get_php_files($path.'/'.$node, $to_ignore));
-            
+
           }
           if ( is_file($path.'/'.$node) )
@@ -44 +44 @@
   $code = preg_replace( '#\/\*.*\*\/#m', '', $code);
   $code = preg_replace( '#\/\/.*#', '', $code);
-  
+
   $count = preg_match_all(
     '#[^a-zA-Z_$-]trigger_(action|event)\s*\(\s*([^,)]+)#m',
@@ -58 +58 @@
 }
 
-$sort= isset($_GET['sort']) ? $_GET['sort'] : 1;
+$sort= isset($_GET['sort']) ? (int)$_GET['sort'] : 1;
 usort(
   $events,