Changeset 987 for branches/branch-1_5/comments.php

Timestamp:

Dec 24, 2005, 4:31:25 PM (18 years ago)

Author:

plg

Message:

bug 245 fixed : GET parameters "since", "sort_by", "sort_order",
"items_number", and "cat" are now checked before being used in SQL queries.

File:

• branches/branch-1_5/comments.php (modified) (5 diffs)

branches/branch-1_5/comments.php

@@ -62 +62 @@
   );
 
-$page['since'] = isset($_GET['since']) ? $_GET['since'] : 1;
+// since
+//
+$page['since'] = 1;
+if (isset($_GET['since']))
+{
+  if (!isset($since_options{ $_GET['since'] }))
+  {
+    die('Hacking attempt on "since" GET parameter');
+  }
+  else
+  {
+    $page['since'] = $_GET['since'];
+  }
+}
 
 // on which field sorting
@@ -70 +83 @@
 if (isset($_GET['sort_by']))
 {
-  $page['sort_by'] = $_GET['sort_by'];
+  if (!isset($sort_by{ $_GET['sort_by'] }))
+  {
+    die('Hacking attempt on "sort_by" GET parameter');
+  }
+  else
+  {
+    $page['sort_by'] = $_GET['sort_by'];
+  }
 }
 
@@ -79 +99 @@
 if (isset($_GET['sort_order']))
 {
-  $page['sort_order'] = $sort_order[$_GET['sort_order']];
+  if (!isset($sort_order{ $_GET['sort_order'] }))
+  {
+    die('Hacking attempt on "sort_order" GET parameter');
+  }
+  else
+  {
+    $page['sort_order'] = $sort_order[$_GET['sort_order']];
+  }
 }
 
@@ -87 +114 @@
 if (isset($_GET['items_number']))
 {
-  $page['items_number'] = $_GET['items_number'];
+  if (!in_array($_GET['items_number'], $items_number))
+  {
+    die('Hacking attempt on "items_number" GET parameter');
+  }
+  else
+  {
+    $page['items_number'] = $_GET['items_number'];
+  }
 }
 
 // which category to filter on ?
 $page['cat_clause'] = '1=1';
-if (isset($_GET['cat']) and 0 != $_GET['cat'])
-{
-  $page['cat_clause'] =
-    'category_id IN ('.implode(',', get_subcat_ids(array($_GET['cat']))).')';
+if (isset($_GET['cat']))
+{
+  if (''.intval($_GET['cat']) != ''.$_GET['cat'])
+  {
+    die('Hacking attempt on "cat" GET parameter');
+  }
+  else if (0 != $_GET['cat'])
+  {
+    $page['cat_clause'] =
+      'category_id IN ('.
+      implode(
+        ',',
+        get_subcat_ids(array($_GET['cat']))
+        ).
+      ')'
+      ;
+  }
 }
 
@@ -128 +175 @@
   $page['keyword_clause'] =
     '('.
-    implode(' AND ',
-            array_map(
-              create_function(
-                '$s',
-                'return "content LIKE \'%$s%\'";'
-                ),
-              preg_split('/[\s,;]+/', $keyword)
-              )
+    implode(
+      ' AND ',
+      array_map(
+        create_function(
+          '$s',
+          'return "content LIKE \'%$s%\'";'
+          ),
+        preg_split('/[\s,;]+/', $keyword)
+        )
       ).
-    ')';
+    ')'
+    ;
 }