aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorrvelices <rv-github@modusoptimus.com>2008-10-16 00:09:53 +0000
committerrvelices <rv-github@modusoptimus.com>2008-10-16 00:09:53 +0000
commit7807d6586a198c75e3d4f72c4b360bee061b817f (patch)
tree016196aa5d873356140bedc4c959c1ae916a2b5e
parent57a366a7a5d5a08f24a5fb0c00bc12c297221d19 (diff)
- fix vulnerability http://www.milw0rm.com/exploits/6755
git-svn-id: http://piwigo.org/svn/branches/2.0@2755 68402e56-0260-453c-a942-63ccdbb3a9ee
-rw-r--r--comments.php4
-rw-r--r--plugins/event_tracer/event_list.php6
2 files changed, 5 insertions, 5 deletions
diff --git a/comments.php b/comments.php
index 555986328..3db7485c8 100644
--- a/comments.php
+++ b/comments.php
@@ -65,7 +65,7 @@ $page['since'] = isset($_GET['since']) ? $_GET['since'] : 4;
//
$page['sort_by'] = 'date';
// if the form was submitted, it overloads default behaviour
-if (isset($_GET['sort_by']))
+if (isset($_GET['sort_by']) and isset($sort_by[$_GET['sort_by']]) )
{
$page['sort_by'] = $_GET['sort_by'];
}
@@ -74,7 +74,7 @@ if (isset($_GET['sort_by']))
//
$page['sort_order'] = 'DESC';
// if the form was submitted, it overloads default behaviour
-if (isset($_GET['sort_order']))
+if (isset($_GET['sort_order']) and isset($sort_order[$_GET['sort_order']]))
{
$page['sort_order'] = $_GET['sort_order'];
}
diff --git a/plugins/event_tracer/event_list.php b/plugins/event_tracer/event_list.php
index ae617fe87..1cde14ef3 100644
--- a/plugins/event_tracer/event_list.php
+++ b/plugins/event_tracer/event_list.php
@@ -16,7 +16,7 @@ function get_php_files($path, $to_ignore=array(), $recursive=true )
if ( $recursive and is_dir($path.'/'.$node) )
{
$files = array_merge($files, get_php_files($path.'/'.$node, $to_ignore));
-
+
}
if ( is_file($path.'/'.$node) )
{
@@ -43,7 +43,7 @@ foreach ($files as $file)
$code = preg_replace( '#\?'.'>.*<\?php#m', '', $code);
$code = preg_replace( '#\/\*.*\*\/#m', '', $code);
$code = preg_replace( '#\/\/.*#', '', $code);
-
+
$count = preg_match_all(
'#[^a-zA-Z_$-]trigger_(action|event)\s*\(\s*([^,)]+)#m',
$code, $matches
@@ -57,7 +57,7 @@ foreach ($files as $file)
}
}
-$sort= isset($_GET['sort']) ? $_GET['sort'] : 1;
+$sort= isset($_GET['sort']) ? (int)$_GET['sort'] : 1;
usort(
$events,
create_function( '$a,$b', 'return $a['.$sort.']>$b['.$sort.'];' )