Security: Add filter for DB port in install scripts

4 years ago · dfae49f5dc
parent ece9eb2c01
commit dfae49f5dc
2 changed files with 2 additions and 1 deletions
--- a/main/install/ajax.php
+++ b/main/install/ajax.php
@ -46,7 +46,7 @@ if ($installType === 'new') {
    $dbName = null;
 }

-$dbPort = isset($_POST['db_port']) ? $_POST['db_port'] : 3306;
+$dbPort = isset($_POST['db_port']) ? (int) $_POST['db_port'] : 3306;

 $manager = connectToDatabase($dbHost, $dbUsername, $dbPass, $dbName, $dbPort);

--- a/main/install/index.php
+++ b/main/install/index.php
@ -279,6 +279,7 @@ if (!isset($_GET['running'])) {
        $GLOBALS[$key] = $_POST[$key];
    }
 }
+$dbPortForm = (int) $dbPortForm;

 /* NEXT STEPS IMPLEMENTATION */