L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rss MDLSITE-1007 processing the user token to make sure its a string and not an int to prevent bogus user matches occuring

Browse Source
This commit is contained in:
Andrew Davis
2010-10-04 07:13:09 +00:00
parent 83b912e0ed
commit a7ca080c20
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/rsslib.php
+2 -1
View File
@@ -346,7 +346,8 @@ function rss_geterrorxmlfile($errortype = 'rsserror') {
function rss_get_userid_from_token($token) {
global $DB;
$record = $DB->get_record('user_private_key', array('script'=>'rss','value' => $token), 'userid', IGNORE_MISSING);
//using strval() to make sure the token is a string not an int. Otherwise passing in numbers like 1 can cause lots of rows to match
$record = $DB->get_record('user_private_key', array('script'=>'rss','value' => strval($token)), 'userid', IGNORE_MISSING);
if ($record) {
return $record->userid;
}