filter api: always treat FILTER_PROPERTY_MATCH_TYPE as an int value

rombert · rombert · commit 45f9e746fb9a · 2013-01-18T22:29:09.000+02:00
Based on @dregad's comments, this follows up on @dhx's fix. Fixes #15373: XSS vulnerability
diff --git a/core/filter_api.php b/core/filter_api.php
@@ -3395,7 +3395,7 @@ function filter_draw_selection_area2( $p_page_number, $p_for_screen = true, $p_e
 					echo lang_get ('filter_match_all');
 				}
 			?>
-			<input type="hidden" name="match_type" value="<?php echo string_attribute( $t_filter[FILTER_PROPERTY_MATCH_TYPE] )?>"/>
+			<input type="hidden" name="match_type" value="<?php echo $t_filter[FILTER_PROPERTY_MATCH_TYPE] ?>"/>
 			</td>
 			<td colspan="6">&#160;</td>
 		</tr>		
diff --git a/view_all_set.php b/view_all_set.php
@@ -233,7 +233,7 @@
 	$f_note_user_id = array( $f_note_user_id );
 }
 
-$f_match_type = gpc_get_string ( FILTER_PROPERTY_MATCH_TYPE, FILTER_MATCH_ALL );
+$f_match_type = gpc_get_int ( FILTER_PROPERTY_MATCH_TYPE, FILTER_MATCH_ALL );
 
 # these are only single values, even when doing advanced filtering
 $f_per_page				= gpc_get_int( FILTER_PROPERTY_ISSUES_PER_PAGE, -1 );

Original file line number	Diff line number	Diff line change
`@@ -3395,7 +3395,7 @@ function filter_draw_selection_area2( $p_page_number, $p_for_screen = true, $p_e`
`3395`	`3395`	`echo lang_get ('filter_match_all');`
`3396`	`3396`	`}`
`3397`	`3397`	`?>`
`3398`		`- <input type="hidden" name="match_type" value="<?php echo string_attribute( $t_filter[FILTER_PROPERTY_MATCH_TYPE] )?>"/>`
	`3398`	`+ <input type="hidden" name="match_type" value="<?php echo $t_filter[FILTER_PROPERTY_MATCH_TYPE] ?>"/>`
`3399`	`3399`	`</td>`
`3400`	`3400`	`<td colspan="6"> </td>`
`3401`	`3401`	`</tr>`
Original file line number	Diff line number	Diff line change
`@@ -233,7 +233,7 @@`
`233`	`233`	`$f_note_user_id = array( $f_note_user_id );`
`234`	`234`	`}`
`235`	`235`
`236`		`-$f_match_type = gpc_get_string ( FILTER_PROPERTY_MATCH_TYPE, FILTER_MATCH_ALL );`
	`236`	`+$f_match_type = gpc_get_int ( FILTER_PROPERTY_MATCH_TYPE, FILTER_MATCH_ALL );`
`237`	`237`
`238`	`238`	`# these are only single values, even when doing advanced filtering`
`239`	`239`	`$f_per_page = gpc_get_int( FILTER_PROPERTY_ISSUES_PER_PAGE, -1 );`