issue60, make sure provided photo id is numeric

[phpfspot.git] / phpfspot.class.php

diff --git a/phpfspot.class.php b/phpfspot.class.php
index 3d707a82fb7137142608091c9a4a627fbc914f29..e0a87a567e184ac83174bc222eee0745dc4ddc61 100644 (file)
--- a/phpfspot.class.php
+++ b/phpfspot.class.php
@@ -112,7 +112,7 @@ class PHPFSPOT {
       switch($_GET['mode']) {
          case 'showpi':
             if(isset($_GET['tags'])) {
-               $_SESSION['selected_tags'] = split(',', $_GET['tags']);
+               $_SESSION['selected_tags'] = $this->extractTags($_GET['tags']);
             }
             if(isset($_GET['from_date']) && $this->isValidDate($_GET['from_date'])) {
                $_SESSION['from_date'] = strtotime($_GET['from_date']);
@@ -123,10 +123,10 @@ class PHPFSPOT {
             break;
          case 'showp':
             if(isset($_GET['tags'])) {
-               $_SESSION['selected_tags'] = split(',', $_GET['tags']);
+               $_SESSION['selected_tags'] = $this->extractTags($_GET['tags']);
                $_SESSION['start_action'] = 'showp';
             }
-            if(isset($_GET['id'])) {
+            if(isset($_GET['id']) && is_numeric($_GET['id'])) {
                $_SESSION['current_photo'] = $_GET['id'];
                $_SESSION['start_action'] = 'showp';
             }
@@ -156,7 +156,6 @@ class PHPFSPOT {
       $this->tmpl->assign('content_page', 'welcome.tpl');
       $this->tmpl->show("index.tpl");
 
-
    } // show()
 
    /**
@@ -1796,6 +1795,20 @@ class PHPFSPOT {
       return strftime("%Y-%m-%d", $timestamp);
    } // ts2str()
 
+   private function extractTags($tags_str)
+   {
+      $not_validated = split(',', $_GET['tags']);
+      $validated = array();
+
+      foreach($not_validated as $tag) {
+         if(is_numeric($tag))
+            array_push($validated, $tag);
+      }
+   
+      return $validated;
+   
+   } // extractTags()
+
 }
 
 ?>