gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge changes from php-gettext 1.0.12

Browse Source 
This ensures that parameter to select_string is numeric, avoiding code
injection through it.

Our code is not vulnerable as we do not pass user supplied values to
this function, this fix is included only to be closer to upstream.

Signed-off-by: Michal Čihař <michal@cihar.com>
This commit is contained in:
Michal Čihař 2017-01-17 13:32:35 +01:00
parent 88cc11ab13
commit 4b5f3f9a12
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libraries/php-gettext/gettext.php
View File

@ -350,6 +350,10 @@ class gettext_reader {
* @return int array index of the right plural form * @return int array index of the right plural form
*/ */
function select_string($n) { function select_string($n) {
if (!is_int($n)) {
throw new InvalidArgumentException(
"Select_string only accepts integers: " . $n);
}
$string = $this->get_plural_forms(); $string = $this->get_plural_forms();
$string = str_replace('nplurals',"\$total",$string); $string = str_replace('nplurals',"\$total",$string);
$string = str_replace("n",$n,$string); $string = str_replace("n",$n,$string);