2.1.26

Fix for #1426
nilsteampassnet · Aug 13, 2016 · 3d85c88 · 3d85c88
1 parent 5b360eb
commit 3d85c88
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 3 deletions.
diff --git a/changelog.md b/changelog.md
@@ -1,5 +1,6 @@
 Last changes
 2.1.26
+ #1426 Fixes for many critical issues with OTV
  #1421 Item will not be automatically deleted when accessed through otv option enabled
  #1414 Subfolders created into personal folders are presented in Folders and Roles management
  #1409 Updated PDF library to fit 7.x PHP

diff --git a/otv.php b/otv.php
@@ -44,8 +44,8 @@
     // check session validity
     $data = DB::queryfirstrow(
         "SELECT id, timestamp, code, item_id FROM ".prefix_table("otv")."
-        WHERE code = %i",
-        intval($_GET['code'])
+        WHERE code = %s",
+        $_GET['code']
     );
     if (
         $data['timestamp'] == intval($_GET['stamp'])

diff --git a/sources/items.queries.php b/sources/items.queries.php
@@ -2703,7 +2703,7 @@
             require_once $_SESSION['settings']['cpassman_dir'] . '/includes/libraries/Encryption/Encryption/ExceptionHandler.php';
 
             // delete all existing old otv codes
-            $rows = DB::query("SELECT id FROM ".prefix_table("otv")." WHERE timestamp < ".(time() - $_SESSION['settings']['otv_expiration_period']));
+            $rows = DB::query("SELECT id FROM ".prefix_table("otv")." WHERE timestamp < ".(time() - $_SESSION['settings']['otv_expiration_period'] * 86400));
             foreach ($rows as $record) {
                 DB::delete(prefix_table('otv'), "id=%i", $record['id']);
             }