Changeset 989

Timestamp:

Dec 25, 2005, 11:37:07 PM (18 years ago)

Author:

plg

Message:

bug 247 fixed : image_id GET parameter was not checked for sanity before
usage in SQL queries. Now, image_id must be a numeric value.

File:

• branches/branch-1_5/picture.php (modified) (1 diff)

branches/branch-1_5/picture.php

@@ -43 +43 @@
   check_restrictions( $page['cat'] );
 }
+
+if (!is_numeric($_GET['image_id']))
+{
+  die('Hacking attempt on "image_id" GET parameter');
+}
+
 //---------------------------------------- incrementation of the number of hits
 $query = '