valvin
/
ttrss
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

force cast profile id to integer when assigning to session variable

This commit is contained in:
Andrew Dolgov 2018-12-06 07:08:54 +03:00
parent f33cd597be
commit 19e24b4fe2
3 changed files with 5 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
classes/handler/public.php
View File

@ -509,7 +509,7 @@ class Handler_Public extends Handler {
if (clean($_POST["profile"])) {
$profile = clean($_POST["profile"]);
$profile = (int) clean($_POST["profile"]);
$sth = $this->pdo->prepare("SELECT id FROM ttrss_settings_profiles
WHERE id = ? AND owner_uid = ?");
@ -517,6 +517,8 @@ class Handler_Public extends Handler {
if ($sth->fetch()) {
$_SESSION["profile"] = $profile;
} else {
$_SESSION["profile"] = null;
}
}
} else {

4
classes/pref/prefs.php
View File

@ -454,13 +454,9 @@ class Pref_Prefs extends Handler_Protected {
$profile = $_SESSION["profile"];
if (!is_numeric($profile) || !$profile || get_schema_version() < 63) $profile = null;
if ($profile) {
print_notice(__("Some preferences are only available in default profile."));
}
if ($_SESSION["profile"]) {
initialize_user_prefs($_SESSION["uid"], $profile);
} else {
initialize_user_prefs($_SESSION["uid"]);

2
classes/rpc.php
View File

@ -8,7 +8,7 @@ class RPC extends Handler_Protected {
}
function setprofile() {
$_SESSION["profile"] = clean($_REQUEST["id"]);
$_SESSION["profile"] = (int) clean($_REQUEST["id"]);
// default value
if (!$_SESSION["profile"]) $_SESSION["profile"] = null;