gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use intval to prevent XSS instead, and use numeric to check valid datatype

Browse Source 
Fix #12382

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
This commit is contained in:
Deven Bansod 2016-09-21 21:24:00 +05:30
parent 54063a75c3
commit adcaf7ca4b
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libraries/controllers/table/TableSearchController.php
View File

@ -461,7 +461,7 @@ class TableSearchController extends TableController
}
$key = array_search($field, $this->_columnNames);
$search_index = 0;
if (PMA_isValid($_REQUEST['it'], 'integer')) {
if (PMA_isValid(intval($_REQUEST['it']), 'numeric')) {
$search_index = $_REQUEST['it'];
}
$properties = $this->getColumnProperties($search_index, $key);