aboutsummaryrefslogtreecommitdiffstats
path: root/include/ws_functions.inc.php
diff options
context:
space:
mode:
authorrvelices <rv-github@modusoptimus.com>2008-10-17 01:06:00 +0000
committerrvelices <rv-github@modusoptimus.com>2008-10-17 01:06:00 +0000
commit93313d760c7e0db93f00ab2ff972b1495a8d67ae (patch)
tree0d0c82033087fb494cc6bd27d4cd95916846c4f2 /include/ws_functions.inc.php
parent376bd21335bacde9ba8afaaa0cdc8b32601e3c7a (diff)
- mysql potential injection paranoia + code compaction in common.inc.php
git-svn-id: http://piwigo.org/svn/branches/2.0@2765 68402e56-0260-453c-a942-63ccdbb3a9ee
Diffstat (limited to '')
-rw-r--r--include/ws_functions.inc.php10
1 files changed, 6 insertions, 4 deletions
diff --git a/include/ws_functions.inc.php b/include/ws_functions.inc.php
index e4470f6c4..4bf48578a 100644
--- a/include/ws_functions.inc.php
+++ b/include/ws_functions.inc.php
@@ -187,6 +187,7 @@ function ws_caddie_add($params, &$service)
{
return new PwgError(401, 'Access denied');
}
+ $params['image_id'] = array_map( 'intval',$params['image_id'] );
if ( empty($params['image_id']) )
{
return new PwgError(WS_ERR_INVALID_PARAM, "Invalid image_id");
@@ -291,7 +292,7 @@ SELECT i.*, GROUP_CONCAT(category_id) cat_ids
AND ', $where_clauses).'
GROUP BY i.id
'.$order_by.'
-LIMIT '.$params['per_page']*$params['page'].','.$params['per_page'];
+LIMIT '.(int)($params['per_page']*$params['page']).','.(int)$params['per_page'];
$result = pwg_query($query);
while ($row = mysql_fetch_assoc($result))
@@ -683,8 +684,8 @@ SELECT id, date, author, content
FROM '.COMMENTS_TABLE.'
WHERE '.$where_comments.'
ORDER BY date
- LIMIT '.$params['comments_per_page']*(int)$params['comments_page'].
- ','.$params['comments_per_page'];
+ LIMIT '.(int)($params['comments_per_page']*$params['comments_page']).
+ ','.(int)$params['comments_per_page'];
$result = pwg_query($query);
while ($row = mysql_fetch_assoc($result))
@@ -857,6 +858,7 @@ function ws_images_setPrivacyLevel($params, &$service)
{
return new PwgError(401, 'Access denied');
}
+ $params['image_id'] = array_map( 'intval',$params['image_id'] );
if ( empty($params['image_id']) )
{
return new PwgError(WS_ERR_INVALID_PARAM, "Invalid image_id");
@@ -1262,7 +1264,7 @@ SELECT DISTINCT i.* FROM '.IMAGES_TABLE.' i
WHERE '. implode('
AND ', $where_clauses).'
'.$order_by.'
-LIMIT '.$params['per_page']*$params['page'].','.$params['per_page'];
+LIMIT '.(int)($params['per_page']*$params['page']).','.(int)$params['per_page'];
$result = pwg_query($query);
while ($row = mysql_fetch_assoc($result))