r28160 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r28159‎ | r28160 | r28161 >
Date:22:44, 4 December 2007
Author:amidaniel
Status:old
Tags:
Comment:
Ensure offset provided to Special:Undelete is numerical (to prevent SQL injection).
Modified paths:
  • /trunk/phase3/includes/SpecialUndelete.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/SpecialUndelete.php
@@ -100,7 +100,7 @@
101101 function listRevisions( $startTime, $limit ) {
102102 $whereClause = array( 'ar_namespace' => $this->title->getNamespace(),
103103 'ar_title' => $this->title->getDBkey() );
104 - if ( $startTime )
 104+ if ( $startTime && is_numeric($startTime) )
105105 $whereClause[] = "ar_timestamp < $startTime";
106106
107107 $dbr = wfGetDB( DB_SLAVE );

Status & tagging log