From 2bfad8017e133fddd6af62c5783b3c104b09c643 Mon Sep 17 00:00:00 2001 From: gRoussac Date: Thu, 16 May 2013 18:30:58 +0200 Subject: [PATCH] [-] CORE : Fix bug #PSCFI-7168 cast and truncate POST values for statistics.php controller --- controllers/front/StatisticsController.php | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/controllers/front/StatisticsController.php b/controllers/front/StatisticsController.php index b583d284c..e3b9c5c83 100644 --- a/controllers/front/StatisticsController.php +++ b/controllers/front/StatisticsController.php @@ -54,17 +54,17 @@ class StatisticsControllerCore extends FrontController if (sha1($id_guest._COOKIE_KEY_) != $this->param_token) die; - $guest = new Guest($id_guest); + $guest = new Guest((int)substr($_POST['id_guest'],0,10)); $guest->javascript = true; - $guest->screen_resolution_x = (int)Tools::getValue('screen_resolution_x'); - $guest->screen_resolution_y = (int)Tools::getValue('screen_resolution_y'); - $guest->screen_color = (int)Tools::getValue('screen_color'); - $guest->sun_java = (int)Tools::getValue('sun_java'); - $guest->adobe_flash = (int)Tools::getValue('adobe_flash'); - $guest->adobe_director = (int)Tools::getValue('adobe_director'); - $guest->apple_quicktime = (int)Tools::getValue('apple_quicktime'); - $guest->real_player = (int)Tools::getValue('real_player'); - $guest->windows_media = (int)Tools::getValue('windows_media'); + $guest->screen_resolution_x = (int)substr($_POST['screen_resolution_x'],0,5); + $guest->screen_resolution_y = (int)substr($_POST['screen_resolution_y'],0,5); + $guest->screen_color = (int)substr($_POST['screen_color'],0,3); + $guest->sun_java = (int)substr($_POST['sun_java'],0,1); + $guest->adobe_flash = (int)substr($_POST['adobe_flash'],0,1); + $guest->adobe_director = (int)substr($_POST['adobe_director'],0,1); + $guest->apple_quicktime = (int)substr($_POST['apple_quicktime'],0,1); + $guest->real_player = (int)substr($_POST['real_player'],0,1); + $guest->windows_media = (int)substr($_POST['windows_media'],0,1); $guest->update(); }