cvs: php-bugs-web / lbugs.php
| From: | Derick Rethans | Date: | Thu, 18 Dec 2008 11:36:56 +0000 |
| Subject: | cvs: php-bugs-web / lbugs.php | ||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-3346@lists.php.net to get a copy of this message | ||
derick Thu Dec 18 11:36:56 2008 UTC
Modified files:
/php-bugs-web lbugs.php
Log:
- Fixed XSS injection by casting the ID to an integer.
http://cvs.php.net/viewvc.cgi/php-bugs-web/lbugs.php?r1=1.16&r2=1.17&diff_format=u
Index: php-bugs-web/lbugs.php
diff -u php-bugs-web/lbugs.php:1.16 php-bugs-web/lbugs.php:1.17
--- php-bugs-web/lbugs.php:1.16 Thu Oct 16 12:07:14 2008
+++ php-bugs-web/lbugs.php Thu Dec 18 11:36:55 2008
@@ -5,6 +5,7 @@
mysql_select_db("phpbugdb");
if ($id) {
+ $id = (int) $id;
$result = mysql_query("SELECT
id,bug_type,email,sdesc,ldesc,php_version,php_os,status,ts1,assign FROM bugdb WHERE id=$id");
if(!$result) { echo mysql_error(); exit; }
if ($num = mysql_num_rows($result)) {