filter api: always treat FILTER_PROPERTY_MATCH_TYPE as an int value

Based on @dregad's comments, this follows up on @dhx's fix. Fixes #15373: XSS vulnerability
mantisbt · Jan 18, 2013 · 610da6e · 610da6e
1 parent bbc6b4f
commit 610da6e
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/core/filter_api.php b/core/filter_api.php
@@ -3400,7 +3400,7 @@ function <?php echo $t_js_toggle_func;?>() {
 					echo lang_get ('filter_match_all');
 				}
 			?>
-			<input type="hidden" name="match_type" value="<?php echo string_attribute( $t_filter[FILTER_PROPERTY_MATCH_TYPE] )?>"/>
+			<input type="hidden" name="match_type" value="<?php echo $t_filter[FILTER_PROPERTY_MATCH_TYPE] ?>"/>
 			</td>
 			<td colspan="6">&#160;</td>
 		</tr>

diff --git a/view_all_set.php b/view_all_set.php
@@ -202,7 +202,7 @@
         $f_note_user_id = array( $f_note_user_id );
     }
 
-    $f_match_type = gpc_get_string ( FILTER_PROPERTY_MATCH_TYPE, FILTER_MATCH_ALL );
+    $f_match_type = gpc_get_int( FILTER_PROPERTY_MATCH_TYPE, FILTER_MATCH_ALL );
 
 	# these are only single values, even when doing advanced filtering
 	$f_per_page				= gpc_get_int( FILTER_PROPERTY_ISSUES_PER_PAGE, -1 );