r51050 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r51049‎ | r51050 | r51051 >
Date:07:20, 27 May 2009
Author:tstarling
Status:deferred
Tags:
Comment:
* Double-validate integers to avoid SQL injection risk
* Handle images with zero pages gracefully, without SQL errors
Modified paths:
  • /trunk/extensions/ProofreadPage/ProofreadPage.php (modified) (history)

Diff [purge]

Index: trunk/extensions/ProofreadPage/ProofreadPage.php
@@ -88,7 +88,7 @@
8989 $pagenr = intval( array_pop( $parts ) );
9090 }
9191 $count = $image->pageCount();
92 - if ( $pagenr < 1 || $pagenr > $count || $count == 1 )
 92+ if ( $pagenr < 1 || $pagenr > $count || $count <= 1 )
9393 return $err;
9494 $name = $image->getTitle()->getText();
9595 $index_name = "$index_namespace:$name";
@@ -128,7 +128,7 @@
129129 $pagenr = intval( array_pop( $parts ) );
130130 }
131131 $count = $image->pageCount();
132 - if ( $pagenr < 1 || $pagenr > $count || $count == 1 ) {
 132+ if ( $pagenr < 1 || $pagenr > $count || $count <= 1 ) {
133133 return $err;
134134 }
135135 $name = $image->getTitle()->getText();
@@ -412,7 +412,7 @@
413413 } else {
414414 $query .= ', ';
415415 }
416 - $query .= $id;
 416+ $query .= intval( $id );
417417 }
418418 }
419419
@@ -451,7 +451,7 @@
452452 $sk = $wgUser->getSkin();
453453
454454 $image = $imgpage->img;
455 - if ( !$image->isMultipage() ) {
 455+ if ( !$image->isMultiPage() ) {
456456 return true;
457457 }
458458
@@ -603,7 +603,7 @@
604604 $image = wfFindFile( $imageTitle );
605605 $return = "";
606606
607 - if ( $image && $image->isMultipage() ) {
 607+ if ( $image && $image->isMultiPage() && $image->pageCount() ) {
608608 $name = $imageTitle->getDBkey();
609609 $count = $image->pageCount();
610610 $dbr = wfGetDB( DB_SLAVE );
@@ -618,7 +618,7 @@
619619 for ( $i = 0; $i < $count ; $i++ ) {
620620 if ( !isset( $query ) ) {
621621 $query = "SELECT page_id, page_title, page_namespace";
622 - $query .= " FROM $pagetable WHERE (page_namespace=$page_ns_index AND page_title IN(";
 622+ $query .= " FROM $pagetable WHERE (page_namespace=" . intval( $page_ns_index ) . " AND page_title IN(";
623623 } else {
624624 $query .= ', ';
625625 }

Status & tagging log