Permalink
Browse files

filter api: always treat FILTER_PROPERTY_MATCH_TYPE as an int value

Based on @dregad's comments, this follows up on @dhx's fix.

Fixes #15373: XSS vulnerability
  • Loading branch information...
rombert committed Jan 18, 2013
1 parent bbc6b4f commit 610da6ecda08239187bc12bf9bf35ba4d27f1920
Showing with 2 additions and 2 deletions.
  1. +1 −1 core/filter_api.php
  2. +1 −1 view_all_set.php
View
@@ -3400,7 +3400,7 @@ function <?php echo $t_js_toggle_func;?>() {
echo lang_get ('filter_match_all');
}
?>
- <input type="hidden" name="match_type" value="<?php echo string_attribute( $t_filter[FILTER_PROPERTY_MATCH_TYPE] )?>"/>
+ <input type="hidden" name="match_type" value="<?php echo $t_filter[FILTER_PROPERTY_MATCH_TYPE] ?>"/>
</td>
<td colspan="6">&#160;</td>
</tr>
View
@@ -202,7 +202,7 @@
$f_note_user_id = array( $f_note_user_id );
}
- $f_match_type = gpc_get_string ( FILTER_PROPERTY_MATCH_TYPE, FILTER_MATCH_ALL );
+ $f_match_type = gpc_get_int( FILTER_PROPERTY_MATCH_TYPE, FILTER_MATCH_ALL );
# these are only single values, even when doing advanced filtering
$f_per_page = gpc_get_int( FILTER_PROPERTY_ISSUES_PER_PAGE, -1 );

0 comments on commit 610da6e

Please sign in to comment.