valvin
/
ttrss
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

properly escape login and password in login_sequence() (refs #392)

This commit is contained in:
Andrew Dolgov 2011-11-22 10:43:24 +04:00
parent b9d5537724
commit 92decf4f2d
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
functions.php
View File

@ -2110,8 +2110,8 @@
# try to authenticate user if called from login form
if ($login_action == "do_login") {
$login = $_POST["login"];
$password = $_POST["password"];
$login = db_escape_string($_POST["login"]);
$password = db_escape_string($_POST["password"]);
$remember_me = $_POST["remember_me"];
if (authenticate_user($link, $login, $password)) {

6
modules/pref-prefs.php
View File

@ -21,9 +21,9 @@
if ($subop == "change-password") {
$old_pw = $_POST["old_password"];
$new_pw = $_POST["new_password"];
$con_pw = $_POST["confirm_password"];
$old_pw = db_escape_string($_POST["old_password"]);
$new_pw = db_escape_string($_POST["new_password"]);
$con_pw = db_escape_string($_POST["confirm_password"]);
if ($old_pw == "") {
print "ERROR: ".__("Old password cannot be blank.");