Add int casting to secure query.

7 years ago · cd2a5650c1
parent 20a2464a56
commit cd2a5650c1
1 changed files with 3 additions and 1 deletions
--- a/main/inc/lib/document.lib.php
+++ b/main/inc/lib/document.lib.php
@ -3503,12 +3503,14 @@ class DocumentManager
                $cleanedPath = $parentData['path'];
                $num = substr_count($cleanedPath, '/');

-                $notLikeCondition = null;
+                $notLikeCondition = '';
                for ($i = 1; $i <= $num; $i++) {
                    $repeat = str_repeat('/%', $i + 1);
                    $notLikeCondition .= " AND docs.path NOT LIKE '".Database::escape_string($cleanedPath.$repeat)."' ";
                }

+                $folderId = (int) $folderId;
+
                $folderCondition = " AND
                    docs.id <> $folderId AND
                    docs.path LIKE '".$cleanedPath."/%'