Changeset 1275 for trunk/rss/admin/folders.php

Timestamp:

02/14/06 09:51:16 (3 years ago)

Author:

mbonetti

Message:

Some more fixes for possible sql injections

Files:

• trunk/rss/admin/folders.php (modified) (9 diffs)

trunk/rss/admin/folders.php

@@ -164 +164 @@
     }
 
+    if (isset($_REQUEST['fid'])) {
+        $fid = sanitize($_REQUEST['fid'],RSS_SANITIZER_NUMERIC);
+    }
+
     $ret__ = CST_ADMIN_DOMAIN_FOLDER;
     switch ($__action__) {
 
     case CST_ADMIN_EDIT_ACTION:
-        folder_edit($_REQUEST['fid']);
+        folder_edit($fid);
         $ret__ = CST_ADMIN_DOMAIN_NONE;
         break;
 
     case CST_ADMIN_DELETE_ACTION:
-        $id = $_REQUEST['fid'];
-        assert(is_numeric($id));
-
-        if ($id == 0) {
+
+
+        if ($fid == 0) {
             rss_error(LBL_ADMIN_ERROR_CANT_DELETE_HOME_FOLDER, RSS_ERROR_ERROR,true);
             break;
@@ -182 +185 @@
 
         if (array_key_exists(CST_ADMIN_CONFIRMED,$_POST) && $_POST[CST_ADMIN_CONFIRMED] == LBL_ADMIN_YES) {
-            $sql = "delete from " . getTable("folders") ." where id=$id";
+            $sql = "delete from " . getTable("folders") ." where id=$fid";
             rss_query($sql);
-            $sql = "update " . getTable("channels") ." set parent=" . getRootFolder() . " where parent=$id";
+            $sql = "update " . getTable("channels") ." set parent=" . getRootFolder() . " where parent=$fid";
             rss_query($sql);
         }
@@ -191 +194 @@
         }
         else {
-            list($fname) = rss_fetch_row(rss_query("select name from " .getTable("folders") ." where id = $id"));
+            list($fname) = rss_fetch_row(rss_query("select name from " .getTable("folders") ." where id = $fid"));
 
             echo "<form class=\"box\" method=\"post\" action=\"" .$_SERVER['PHP_SELF'] ."\">\n"
@@ -199 +202 @@
             ."<p><input type=\"submit\" name=\"".CST_ADMIN_CONFIRMED."\" value=\"". LBL_ADMIN_NO ."\"/>\n"
             ."<input type=\"submit\" name=\"".CST_ADMIN_CONFIRMED."\" value=\"". LBL_ADMIN_YES ."\"/>\n"
-            ."<input type=\"hidden\" name=\"fid\" value=\"$id\"/>\n"
+            ."<input type=\"hidden\" name=\"fid\" value=\"$fid\"/>\n"
             ."<input type=\"hidden\" name=\"".CST_ADMIN_DOMAIN."\" value=\"".CST_ADMIN_DOMAIN_FOLDER."\"/>\n"
             ."<input type=\"hidden\" name=\"action\" value=\"". CST_ADMIN_DELETE_ACTION ."\"/>\n"
@@ -208 +211 @@
 
     case CST_ADMIN_SUBMIT_EDIT:
-        $id = $_REQUEST['fid'];
-
+        // TBD
         $new_label = rss_real_escape_string($_REQUEST['f_name']);
-        if (is_numeric($id) && strlen($new_label) > 0) {
+        if (is_numeric($fid) && strlen($new_label) > 0) {
 
             $res = rss_query("select count(*) as cnt from " . getTable("folders") ." where binary name='$new_label'");
@@ -219 +221 @@
                 break;
             }
-            rss_query("update " .getTable("folders") ." set name='$new_label' where id=$id");
+            rss_query("update " .getTable("folders") ." set name='$new_label' where id=$fid");
         }
         break;
@@ -225 +227 @@
     case LBL_ADMIN_ADD:
     case 'LBL_ADMIN_ADD':
-        $label=$_REQUEST['new_folder'];
+        $label=sanitize($_REQUEST['new_folder'],RSS_SANITIZER_SIMPLE_SQL);
         assert(strlen($label) > 0);
         create_folder($label);
@@ -232 +234 @@
     case CST_ADMIN_MOVE_UP_ACTION:
     case CST_ADMIN_MOVE_DOWN_ACTION:
-        $id = $_REQUEST['fid'];
-
-        if ($id == 0) {
+
+        if ($fid == 0) {
             return;
         }
 
-        $res = rss_query("select position from " .getTable("folders") ." where id=$id");
+        $res = rss_query("select position from " .getTable("folders") ." where id=$fid");
         list($position) = rss_fetch_row($res);
 
         $sql = "select id, position from " .getTable("folders")
-               ." where id != $id order by abs($position-position) limit 2";
+               ." where id != $fid order by abs($position-position) limit 2";
 
         $res = rss_query($sql);
@@ -268 +269 @@
         // right, lets!
         if ($switch_with_position != $position) {
-            rss_query( "update " . getTable("folders") ." set position = $switch_with_position where id=$id" );
+            rss_query( "update " . getTable("folders") ." set position = $switch_with_position where id=$fid" );
             rss_query( "update " . getTable("folders") ." set position = $position where id=$switch_with_id" );
         }