archive/piwigo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

merge 2755 and 2756 from branch 2.0 to trunk

Browse source 
- 2755 fix vulnerability http://www.milw0rm.com/exploits/6755
- 2756 security paranoia: protect session/remember me cookies from XSS attacks (works only if php>=5.2 and with IE/FF maybe others)


git-svn-id: http://piwigo.org/svn/trunk@2757 68402e56-0260-453c-a942-63ccdbb3a9ee
This commit is contained in:
rvelices 2008-10-16 00:38:26 +00:00
commit ebc3c2e2f7
6 changed files with 43 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

4
comments.php
View file

@ -65,7 +65,7 @@ $page['since'] = isset($_GET['since']) ? $_GET['since'] : 4;
//
$page['sort_by'] = 'date';
// if the form was submitted, it overloads default behaviour
if (isset($_GET['sort_by']))
if (isset($_GET['sort_by']) and isset($sort_by[$_GET['sort_by']]) )
{
$page['sort_by'] = $_GET['sort_by'];
}
@ -74,7 +74,7 @@ if (isset($_GET['sort_by']))
//
$page['sort_order'] = 'DESC';
// if the form was submitted, it overloads default behaviour
if (isset($_GET['sort_order']))
if (isset($_GET['sort_order']) and isset($sort_order[$_GET['sort_order']]))
{
$page['sort_order'] = $_GET['sort_order'];
}