(cp 9028c75) fixes #825, check user input on Batch Manager, unit mode…

…, to prevent SQL injection
Piwigo · Dec 18, 2017 · f7c8e0a · f7c8e0a
1 parent c3b4c6f
commit f7c8e0a
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/admin/batch_manager_unit.php b/admin/batch_manager_unit.php
@@ -47,6 +47,7 @@
 
 if (isset($_POST['submit']))
 {
+  check_input_parameter('element_ids', $_POST, false, '/^\d+(,\d+)*$/');
   $collection = explode(',', $_POST['element_ids']);
 
   $datas = array();