Changeset 2770 for trunk/include/ws_functions.inc.php

Timestamp:

Oct 18, 2008, 2:45:45 AM (16 years ago)

Author:

rvelices

Message:

• merge rev 2765,2769 from branch 2.0
• 2765 mysql potential injection paranoia + code compaction in common.inc.php
• 2769 added an image sort order by privacy level (admins only)
• 2769 fix an IE6 display issue with quick search on index page

File:

• trunk/include/ws_functions.inc.php (modified) (5 diffs)

trunk/include/ws_functions.inc.php

@@ -188 +188 @@
     return new PwgError(401, 'Access denied');
   }
+  $params['image_id'] = array_map( 'intval',$params['image_id'] );
   if ( empty($params['image_id']) )
   {
@@ -292 +293 @@
 GROUP BY i.id
 '.$order_by.'
-LIMIT '.$params['per_page']*$params['page'].','.$params['per_page'];
+LIMIT '.(int)($params['per_page']*$params['page']).','.(int)$params['per_page'];
 
     $result = pwg_query($query);
@@ -684 +685 @@
   WHERE '.$where_comments.'
   ORDER BY date
-  LIMIT '.$params['comments_per_page']*(int)$params['comments_page'].
-    ','.$params['comments_per_page'];
+  LIMIT '.(int)($params['comments_per_page']*$params['comments_page']).
+    ','.(int)$params['comments_per_page'];
 
     $result = pwg_query($query);
@@ -858 +859 @@
     return new PwgError(401, 'Access denied');
   }
+  $params['image_id'] = array_map( 'intval',$params['image_id'] );
   if ( empty($params['image_id']) )
   {
@@ -1343 +1345 @@
     AND ', $where_clauses).'
 '.$order_by.'
-LIMIT '.$params['per_page']*$params['page'].','.$params['per_page'];
+LIMIT '.(int)($params['per_page']*$params['page']).','.(int)$params['per_page'];
 
     $result = pwg_query($query);