From de3e4de88d0f744574dad87f66afd5c11ce9bc30 Mon Sep 17 00:00:00 2001
From: moodler <moodler>
Date: Tue, 31 Aug 2004 08:52:12 +0000
Subject: [PATCH] Some extra safety when using variables - doesn't appear to be
 an exploit in the general case but thanks, Fernando Quintero

---
 login/confirm.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/login/confirm.php b/login/confirm.php
index cbc3e391bc0..b3461cec9df 100644
--- a/login/confirm.php
+++ b/login/confirm.php
@@ -5,7 +5,7 @@
 
     if (isset($_GET['p']) and isset($_GET['s']) ) {     #  p = user.secret   s = user.username
 
-        $user = get_user_info_from_db("username", "$s");
+        $user = get_user_info_from_db("username", $_GET['s']);
 
         if (!empty($user)) {
 
@@ -18,7 +18,7 @@
                 exit;
             }
 
-            if ($user->secret == $p) {   // They have provided the secret key to get in
+            if ($user->secret == $_GET['p']) {   // They have provided the secret key to get in
 
                 if (!set_field("user", "confirmed", 1, "id", $user->id)) {
                     error("Could not confirm this user!");