aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authornikrou <nikrou@piwigo.org>2006-08-14 20:56:10 +0000
committernikrou <nikrou@piwigo.org>2006-08-14 20:56:10 +0000
commit8c9741dd5684e51d5b09d73e7b74df4843a11747 (patch)
tree5a047e4b400b048e95f655d9a639e7160c3d9eea
parentf784cae8158b41f8cfe2bb1615e285b55828777b (diff)
fix bug 518: anyone can delete or validate a comment
comment_id must be int: use of intval function to use it in the query. git-svn-id: http://piwigo.org/svn/branches/branch-1_6@1535 68402e56-0260-453c-a942-63ccdbb3a9ee
-rw-r--r--comments.php7
1 files changed, 5 insertions, 2 deletions
diff --git a/comments.php b/comments.php
index bd332b46e..829a7055e 100644
--- a/comments.php
+++ b/comments.php
@@ -148,8 +148,9 @@ if (isset($_GET['keyword']) and !empty($_GET['keyword']))
// | comments management |
// +-----------------------------------------------------------------------+
// comments deletion
-if (isset($_POST['delete']) and count($_POST['comment_id']) > 0)
+if (isset($_POST['delete']) and count($_POST['comment_id']) > 0 and is_admin())
{
+ $_POST['comment_id'] = array_map('intval', $_POST['comment_id']);
$query = '
DELETE FROM '.COMMENTS_TABLE.'
WHERE id IN ('.implode(',', $_POST['comment_id']).')
@@ -157,8 +158,10 @@ DELETE FROM '.COMMENTS_TABLE.'
pwg_query($query);
}
// comments validation
-if (isset($_POST['validate']) and count($_POST['comment_id']) > 0)
+if (isset($_POST['validate']) and count($_POST['comment_id']) > 0
+ and is_admin())
{
+ $_POST['comment_id'] = array_map('intval', $_POST['comment_id']);
$query = '
UPDATE '.COMMENTS_TABLE.'
SET validated = \'true\'