Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Check that the tag GET variable is a string #147

Merged
merged 1 commit into from
Dec 30, 2022
Merged

Conversation

hannob
Copy link
Contributor

@hannob hannob commented Dec 29, 2022

By sending a tag variable that is an array one can trigger an uncaught exception. I saw these in my logs, likely due to some internet scans.

This can be reproduced like this:

curl 'https://[host]/rss.php?serendipity\[tag\]\[\]=1'

Fixing this by checking that the var is actually a string, and ignore it otherwise.

@onli onli merged commit 5f00e07 into s9y:master Dec 30, 2022
onli added a commit that referenced this pull request Dec 30, 2022
onli added a commit that referenced this pull request Dec 30, 2022
@onli
Copy link
Member

onli commented Dec 30, 2022

Merged, thanks! I added the changelog in bf35651 (would be ideal if it could be added directly next time :) )

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants