Fixed security problem in account_update.php.

git-svn-id: http://mantisbt.svn.sourceforge.net/svnroot/mantisbt/trunk@988 f5dc347c-c33d-0410-90a0-b07cc1902cb9
mantisbt · May 19, 2002 · 00a2695 · 00a2695
1 parent d2aeba9
commit 00a2695
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/account_update.php b/account_update.php
@@ -25,6 +25,10 @@
 	# This is useful for shared accounts or for demo purposes
 	$result = 0;
 	if ( OFF == $f_protected ) {
+
+    $f_username = addslashes($f_username);
+    $f_email = addslashes($f_email);
+    $f_id = (integer)$f_id;
 
 		# Update everything except password
 	    $query = "UPDATE $g_mantis_user_table

diff --git a/doc/ChangeLog b/doc/ChangeLog
@@ -23,6 +23,7 @@ Mantis
  * Added check for empty bugnotes.
  * Removed view_csv_export_inc.php (unused).
  * Removed print_user_option_list() (unused).
+ * Closed a security problem in account_update.php.
 
 05.12.2002  -   0.17.2
 
@@ -734,3 +735,4 @@ Mantis
  * Access levels
  * News system
  * Basic functionality
+