richard
/
sorbetcms
1
0
Fork 1
Code Issues Pull Requests Releases Wiki Activity

Bug 50 - SQL injection exploit, resolved by checking for valid post id

master
mheitzenroder@gmail.com 2007-09-15 05:02:14 +00:00
parent 770a45a126
commit 2b04a0339c
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
index.php
View File

@ -42,6 +42,9 @@
if (isset($_GET["post"])) { if (isset($_GET["post"])) {
$id_post = $_GET["post"]; $id_post = $_GET["post"];
if (!is_numeric($id_post) && $id_post < 1 ){
header("Location: index.php");
}
} else { } else {
if (isset($param_url[1]) && $param_url[1]=="post") { if (isset($param_url[1]) && $param_url[1]=="post") {
$id_post = (isset($param_url[2])) ? ((is_numeric($param_url[2])) ? $param_url[2] : NULL) : NULL; $id_post = (isset($param_url[2])) ? ((is_numeric($param_url[2])) ? $param_url[2] : NULL) : NULL;