Changeset 30563 for trunk/include/functions_rate.inc.php

Timestamp:

Nov 21, 2014, 1:17:18 PM (10 years ago)

Author:

plg

Message:

bug 3178 fixed, in_array check is not reliable when you compare string (user input) and numeric values

File:

• trunk/include/functions_rate.inc.php (modified) (1 diff)

trunk/include/functions_rate.inc.php

@@ -40 +40 @@
   if (!isset($rate)
       or !$conf['rate']
+      or !preg_match('/^[0-9]+$/', $rate)
       or !in_array($rate, $conf['rate_items']))
   {