cvs: php-bugs-web / search.php
| From: | Derick Rethans | Date: | Thu, 14 Aug 2003 09:17:31 +0000 |
| Subject: | cvs: php-bugs-web / search.php | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-20251@lists.php.net to get a copy of this message | ||
derick Thu Aug 14 05:17:31 2003 EDT
Modified files:
/php-bugs-web search.php
Log:
- Fix unchecked userinput
#- No worries, this couldn't be exploited :)
Index: php-bugs-web/search.php
diff -u php-bugs-web/search.php:1.50 php-bugs-web/search.php:1.51
--- php-bugs-web/search.php:1.50 Tue Jul 15 03:23:47 2003
+++ php-bugs-web/search.php Thu Aug 14 05:17:31 2003
@@ -102,6 +102,7 @@
/* we avoid adding an order by clause if using the full text search */
if ($order_by || $reorder_by || !strlen($search_for)) {
if (!in_array($order_by,$allowed_order)) $order_by = "id";
+ if (!in_array($reorder_by,$allowed_order)) $reorder_by = "id";
if ($direction != "DESC") $direction = "ASC";
if ($reorder_by) {