Security: Add filter on GET data in admin users list - refs BT#21427

ywarnier · ywarnier · commit 3740eece4cdc · 2024-02-22T03:31:05.000+01:00
diff --git a/main/admin/user_list.php b/main/admin/user_list.php
@@ -246,7 +246,7 @@ function prepare_user_sql_query($getCount)
     foreach ($keywordList as $keyword) {
         $keywordListValues[$keyword] = null;
         if (isset($_GET[$keyword]) && !empty($_GET[$keyword])) {
-            $keywordListValues[$keyword] = $_GET[$keyword];
+            $keywordListValues[$keyword] = Security::remove_XSS($_GET[$keyword]);
             $atLeastOne = true;
         }
     }

Original file line number	Diff line number	Diff line change
`@@ -246,7 +246,7 @@ function prepare_user_sql_query($getCount)`
`246`	`246`	`foreach ($keywordList as $keyword) {`
`247`	`247`	`$keywordListValues[$keyword] = null;`
`248`	`248`	`if (isset($_GET[$keyword]) && !empty($_GET[$keyword])) {`
`249`		`- $keywordListValues[$keyword] = $_GET[$keyword];`
	`249`	`+ $keywordListValues[$keyword] = Security::remove_XSS($_GET[$keyword]);`
`250`	`250`	`$atLeastOne = true;`
`251`	`251`	`}`
`252`	`252`	`}`