fix sql injection security vulnerability; reported by Nicky [#1394 st…

…ate:resolved] [#1395 state:resolved]
exponentcms · Nov 6, 2016 · fffb203 · fffb203 · futurelighthouse · Nov 11, 2016
1 parent 4327ea9
commit fffb203
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/framework/core/controllers/expController.php b/framework/core/controllers/expController.php
@@ -772,7 +772,7 @@ public function manage_ranks() {
         $rank = 1;
         foreach ($this->params['rerank'] as $id) {
             $modelname = $this->params['model'];
-            $obj = new $modelname($id);
+            $obj = new $modelname(intval($id));
             $obj->rank = $rank;
             $obj->save(false, true);
             $rank++;