filter api: always treat FILTER_PROPERTY_MATCH_TYPE as an int value

rombert · rombert · commit 610da6ecda08 · 2013-01-18T22:22:30.000+02:00
Based on @dregad's comments, this follows up on @dhx's fix. Fixes #15373: XSS vulnerability
diff --git a/core/filter_api.php b/core/filter_api.php
@@ -3400,7 +3400,7 @@ function <?php echo $t_js_toggle_func;?>() {
 					echo lang_get ('filter_match_all');
 				}
 			?>
-			<input type="hidden" name="match_type" value="<?php echo string_attribute( $t_filter[FILTER_PROPERTY_MATCH_TYPE] )?>"/>
+			<input type="hidden" name="match_type" value="<?php echo $t_filter[FILTER_PROPERTY_MATCH_TYPE] ?>"/>
 			</td>
 			<td colspan="6">&#160;</td>
 		</tr>
diff --git a/view_all_set.php b/view_all_set.php
@@ -202,7 +202,7 @@
         $f_note_user_id = array( $f_note_user_id );
     }
     
-    $f_match_type = gpc_get_string ( FILTER_PROPERTY_MATCH_TYPE, FILTER_MATCH_ALL );
+    $f_match_type = gpc_get_int( FILTER_PROPERTY_MATCH_TYPE, FILTER_MATCH_ALL );
 
 	# these are only single values, even when doing advanced filtering
 	$f_per_page				= gpc_get_int( FILTER_PROPERTY_ISSUES_PER_PAGE, -1 );

Original file line number	Diff line number	Diff line change
`@@ -3400,7 +3400,7 @@ function <?php echo $t_js_toggle_func;?>() {`
`3400`	`3400`	`echo lang_get ('filter_match_all');`
`3401`	`3401`	`}`
`3402`	`3402`	`?>`
`3403`		`- <input type="hidden" name="match_type" value="<?php echo string_attribute( $t_filter[FILTER_PROPERTY_MATCH_TYPE] )?>"/>`
	`3403`	`+ <input type="hidden" name="match_type" value="<?php echo $t_filter[FILTER_PROPERTY_MATCH_TYPE] ?>"/>`
`3404`	`3404`	`</td>`
`3405`	`3405`	`<td colspan="6"> </td>`
`3406`	`3406`	`</tr>`
Original file line number	Diff line number	Diff line change
`@@ -202,7 +202,7 @@`
`202`	`202`	`$f_note_user_id = array( $f_note_user_id );`
`203`	`203`	`}`
`204`	`204`
`205`		`- $f_match_type = gpc_get_string ( FILTER_PROPERTY_MATCH_TYPE, FILTER_MATCH_ALL );`
	`205`	`+ $f_match_type = gpc_get_int( FILTER_PROPERTY_MATCH_TYPE, FILTER_MATCH_ALL );`
`206`	`206`
`207`	`207`	`# these are only single values, even when doing advanced filtering`
`208`	`208`	`$f_per_page = gpc_get_int( FILTER_PROPERTY_ISSUES_PER_PAGE, -1 );`