Changeset 1788 for trunk

Timestamp:

07/26/08 11:12:53 (4 months ago)

Author:

mbonetti

Message:

fixes #510

Files:

• trunk/gregarius/ajax.php (modified) (3 diffs)

trunk/gregarius/ajax.php

@@ -33 +33 @@
 
 function __exp__setState($id,$state) {
+    $id = sanitize($id, RSS_SANITIZER_NUMERIC);
+    $state = sanitize($state, RSS_SANITIZER_NUMERIC);
     if (isLoggedIn()) {
         rss_query('update '.getTable('item') . " set unread=$state where id=$id");  
@@ -71 +73 @@
 
 function __exp__getFeedContent($cid) {
-
+    $cid = sanitize($cid, RSS_SANITIZER_NUMERIC);
     
     ob_start();
@@ -91 +93 @@
 
 function __exp__rateItem($iid, $rt) {
+    $iid = sanitize($iid, RSS_SANITIZER_NUMERIC);
+    $rt = sanitize($rt, RSS_SANITIZER_NUMERIC);
+    
     list($rrt) = rss_fetch_row(rss_query("select rating from "
         .getTable('rating') . " where iid = $iid"));