From 8c9741dd5684e51d5b09d73e7b74df4843a11747 Mon Sep 17 00:00:00 2001 From: nikrou Date: Mon, 14 Aug 2006 20:56:10 +0000 Subject: fix bug 518: anyone can delete or validate a comment comment_id must be int: use of intval function to use it in the query. git-svn-id: http://piwigo.org/svn/branches/branch-1_6@1535 68402e56-0260-453c-a942-63ccdbb3a9ee --- comments.php | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/comments.php b/comments.php index bd332b46e..829a7055e 100644 --- a/comments.php +++ b/comments.php @@ -148,8 +148,9 @@ if (isset($_GET['keyword']) and !empty($_GET['keyword'])) // | comments management | // +-----------------------------------------------------------------------+ // comments deletion -if (isset($_POST['delete']) and count($_POST['comment_id']) > 0) +if (isset($_POST['delete']) and count($_POST['comment_id']) > 0 and is_admin()) { + $_POST['comment_id'] = array_map('intval', $_POST['comment_id']); $query = ' DELETE FROM '.COMMENTS_TABLE.' WHERE id IN ('.implode(',', $_POST['comment_id']).') @@ -157,8 +158,10 @@ DELETE FROM '.COMMENTS_TABLE.' pwg_query($query); } // comments validation -if (isset($_POST['validate']) and count($_POST['comment_id']) > 0) +if (isset($_POST['validate']) and count($_POST['comment_id']) > 0 + and is_admin()) { + $_POST['comment_id'] = array_map('intval', $_POST['comment_id']); $query = ' UPDATE '.COMMENTS_TABLE.' SET validated = \'true\' -- cgit v1.2.3