[Noalyss-commit] [noalyss] 06/27: Security : avoid direct call to Http Variable

[Dany De Bontridder]

sparkyx pushed a commit to branch master
in repository noalyss.

commit 57153bea0e813c1fee72870824c5f8578341797b
Author: Dany De Bontridder <address@hidden>
Date:   Tue Aug 27 18:58:04 2019 +0200

    Security : avoid direct call to Http Variable
---
 include/history_operation.inc.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/include/history_operation.inc.php 
b/include/history_operation.inc.php
index 420a324..50f0e11 100644
--- a/include/history_operation.inc.php
+++ b/include/history_operation.inc.php
@@ -110,6 +110,11 @@ $max_line = $cn->count_sql($sql);
 $step = $_SESSION['g_pagesize'];
 $page = (isset($_GET['offset'])) ? $_GET['page'] : 1;
 $offset = (isset($_GET['offset'])) ? $_GET['offset'] : 0;
+
+// check if number
+$page=(isNumber($page)==0)?1:$page;
+$offset=(isNumber($offset)==0)?0:$offset;
+
 $bar = navigation_bar($offset, $max_line, $step, $page);
 
 echo $msg;