r102133 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r102132‎ | r102133 | r102134 >
Date:00:29, 6 November 2011
Author:ashley
Status:ok
Tags:
Comment:
SocialProfile: as per Markus' in-depth review: wrap $response in an intval() call to make the code demonstratably secure
Modified paths:
  • /trunk/extensions/SocialProfile/UserRelationship/Relationship_AjaxFunctions.php (modified) (history)

Diff [purge]

Index: trunk/extensions/SocialProfile/UserRelationship/Relationship_AjaxFunctions.php
@@ -16,7 +16,7 @@
1717 $rel_type = strtolower( $request[0]['type'] );
1818
1919 $response = ( isset( $_POST['response' ] ) ) ? $_POST['response'] : $response;
20 - $rel->updateRelationshipRequestStatus( $requestId, $response );
 20+ $rel->updateRelationshipRequestStatus( $requestId, intval( $response ) );
2121
2222 $avatar = new wAvatar( $user_id_from, 'l' );
2323 $avatar_img = $avatar->getAvatarURL();
@@ -37,5 +37,6 @@
3838 }
3939 $rel->deleteRequest( $requestId );
4040 }
 41+
4142 return $out;
4243 }

Status & tagging log