svn: /web/php-master/trunk/fetch/ events.php
| From: | Hannes Magnusson | Date: | Sat, 30 Jul 2011 21:47:06 +0000 |
| Subject: | svn: /web/php-master/trunk/fetch/ events.php | ||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-11810@lists.php.net to get a copy of this message | ||
bjori Sat, 30 Jul 2011 21:47:06 +0000
Revision: http://svn.php.net/viewvc?view=revision&revision=313986
Log:
Fix sql injection by Wolegequ.
Changed paths:
U web/php-master/trunk/fetch/events.php
Modified: web/php-master/trunk/fetch/events.php
===================================================================
--- web/php-master/trunk/fetch/events.php 2011-07-30 19:57:26 UTC (rev 313985)
+++ web/php-master/trunk/fetch/events.php 2011-07-30 21:47:06 UTC (rev 313986)
@@ -13,6 +13,12 @@
if (!isset($cd)) $cd = (int)strftime('%d');
if (!isset($nm)) $nm = 3;
+// Fix sql injection. args must be integer
+$cm = (int) $cm;
+$cy = (int) $cy;
+$cd = (int) $cd;
+$nm = (int) $nm;
+
// Collect events for $nm number of months
while ($nm) {
for($cat=1; $cat<=3; $cat++) {