cvs: php4 /pear DB.php
| From: | Thomas V.V.Cox | Date: | Fri, 01 Feb 2002 16:36:32 +0000 |
| Subject: | cvs: php4 /pear DB.php | ||
| Groups: | php.pear.cvs | ||
| Request: | Send a blank email to pear-cvs+get-2273@lists.php.net to get a copy of this message | ||
cox Fri Feb 1 11:36:32 2002 EDT
Modified files:
/php4/pear DB.php
Log:
Fix remote security risk, pointed out by Wolfram Kriesing
Index: php4/pear/DB.php
diff -u php4/pear/DB.php:1.84 php4/pear/DB.php:1.85
--- php4/pear/DB.php:1.84 Fri Feb 1 10:03:17 2002
+++ php4/pear/DB.php Fri Feb 1 11:36:32 2002
@@ -17,7 +17,7 @@
// | Tomas V.V.Cox <cox@idecnet.com> |
// +----------------------------------------------------------------------+
//
-// $Id: DB.php,v 1.84 2002/02/01 15:03:17 cox Exp $
+// $Id: DB.php,v 1.85 2002/02/01 16:36:32 cox Exp $
//
// Database independent query interface.
//
@@ -534,7 +534,9 @@
}
foreach ($opts as $opt) {
list($key, $value) = explode('=', $opt);
- $parsed[$key] = urldecode($value);
+ if (!isset($parsed[$key])) { // don't allow params overwrite
+ $parsed[$key] = urldecode($value);
+ }
}
}
}