tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Use bound parameters for every query that takes user data.

Browse Source 
The queue image query took $id without quotes or a check, which allowed
SQL injection.
This commit is contained in:
tim
2026-09-25 21:29:09 +02:00
parent cda0602c95
commit c85f54116c
7 changed files with 70 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files
navigation.lib.php
+3 -3
View File
@@ -33,7 +33,7 @@ function sort_options($link) {
} else {
$href = '<a href="'.$link.'?sort='.$sort_key.'&amp;order='.$order_key;
if (isset($_GET['queue'])) $href .= '&amp;queue='.$_GET['queue'];
if (isset($_GET['search'])) $href .= '&amp;search='.$search;
if (isset($_GET['search'])) $href .= '&amp;search='.urlencode((string)$search);
if (isset($_GET['start'])) $href .= '&amp;start='.$start;
if (isset($_GET['show'])) $href .= '&amp;show='.$show;
$href .= '">'.$display.'</a>';
@@ -71,7 +71,7 @@ function get_pager() {
if ($start > 0) {
$string .= "\n".'<a href="'.$link.'?start='.$next;
if (isset($_GET['queue'])) $string .= '&amp;queue='.$queue_url;
if (isset($_GET['search'])) $string .= '&amp;search='.$search;
if (isset($_GET['search'])) $string .= '&amp;search='.urlencode((string)$search);
if (isset($_GET['show'])) $string .= '&amp;show='.$show;
if (isset($_GET['sort'])) $string .= '&amp;sort='.$sort;
if (isset($_GET['order'])) $string .= '&amp;order='.$order;
@@ -85,7 +85,7 @@ function get_pager() {
if ($prev < get_count()) {
$string .= "\n".'<a href="'.$link.'?start='.$prev;
if (isset($_GET['queue'])) $string .= '&amp;queue='.$queue_url;
if (isset($_GET['search'])) $string .= '&amp;search='.$search;
if (isset($_GET['search'])) $string .= '&amp;search='.urlencode((string)$search);
if (isset($_GET['show'])) $string .= '&amp;show='.$show;
if (isset($_GET['sort'])) $string .= '&amp;sort='.$sort;
if (isset($_GET['order'])) $string .= '&amp;order='.$order;