public/tt-rss
1
0
Fork 0
mirror of https://git.tt-rss.org/git/tt-rss.git synced 2025-12-13 22:35:55 +00:00
Code Issues Releases Wiki Activity

force cast profile id to integer when assigning to session variable

Browse Source
This commit is contained in:
Andrew Dolgov
2018-12-06 07:08:54 +03:00
parent f33cd597be
commit 19e24b4fe2
3 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
classes/handler/public.php
View File

@@ -509,7 +509,7 @@ class Handler_Public extends Handler {
if (clean($_POST["profile"])) { if (clean($_POST["profile"])) {
$profile = clean($_POST["profile"]); $profile = (int) clean($_POST["profile"]);
$sth = $this->pdo->prepare("SELECT id FROM ttrss_settings_profiles $sth = $this->pdo->prepare("SELECT id FROM ttrss_settings_profiles
WHERE id = ? AND owner_uid = ?"); WHERE id = ? AND owner_uid = ?");
@@ -517,6 +517,8 @@ class Handler_Public extends Handler {
if ($sth->fetch()) { if ($sth->fetch()) {
$_SESSION["profile"] = $profile; $_SESSION["profile"] = $profile;
} else {
$_SESSION["profile"] = null;
} }
} }
} else { } else {

4
classes/pref/prefs.php
View File

@@ -454,13 +454,9 @@ class Pref_Prefs extends Handler_Protected {
$profile = $_SESSION["profile"]; $profile = $_SESSION["profile"];
if (!is_numeric($profile) || !$profile || get_schema_version() < 63) $profile = null;
if ($profile) { if ($profile) {
print_notice(__("Some preferences are only available in default profile.")); print_notice(__("Some preferences are only available in default profile."));
}
if ($_SESSION["profile"]) {
initialize_user_prefs($_SESSION["uid"], $profile); initialize_user_prefs($_SESSION["uid"], $profile);
} else { } else {
initialize_user_prefs($_SESSION["uid"]); initialize_user_prefs($_SESSION["uid"]);

2
classes/rpc.php
View File

@@ -8,7 +8,7 @@ class RPC extends Handler_Protected {
} }
function setprofile() { function setprofile() {
$_SESSION["profile"] = clean($_REQUEST["id"]); $_SESSION["profile"] = (int) clean($_REQUEST["id"]);
// default value // default value
if (!$_SESSION["profile"]) $_SESSION["profile"] = null; if (!$_SESSION["profile"]) $_SESSION["profile"] = null;