bug 3089: prevent SQL injection on photo edition

git-svn-id: http://piwigo.org/svn/trunk@28678 68402e56-0260-453c-a942-63ccdbb3a9ee
Piwigo · Jun 12, 2014 · 2797290 · 2797290
1 parent 2384b31
commit 2797290
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/admin/picture_modify.php b/admin/picture_modify.php
@@ -155,6 +155,7 @@
   {
     $_POST['associate'] = array();
   }
+  check_input_parameter('associate', $_POST, true, PATTERN_ID);
   move_images_to_categories(array($_GET['image_id']), $_POST['associate']);
 
   invalidate_user_cache();
@@ -164,6 +165,7 @@
   {
     $_POST['represent'] = array();
   }
+  check_input_parameter('represent', $_POST, true, PATTERN_ID);
 
   $no_longer_thumbnail_for = array_diff($represented_albums, $_POST['represent']);
   if (count($no_longer_thumbnail_for) > 0)