mantisbt my_view_page.php,1.12,1.12.8.1 view_all_inc.php,1.161,1.161.10.1

Update of /cvsroot/mantisbt/mantisbt
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv25507

Modified Files:
      Tag: BRANCH_1_0_0rc5
        my_view_page.php view_all_inc.php 
Log Message:
fix for 0006436: code injection
  - fixed 1 possible code injection and 2 XSS injections


Index: view_all_inc.php
===================================================================
RCS file: /cvsroot/mantisbt/mantisbt/view_all_inc.php,v
retrieving revision 1.161
retrieving revision 1.161.10.1
diff -u -d -r1.161 -r1.161.10.1
--- view_all_inc.php    18 Jul 2005 18:56:59 -0000      1.161
+++ view_all_inc.php    24 Jan 2006 04:10:44 -0000      1.161.10.1
@@ -73,7 +73,7 @@
                        $v_end   = 0;
 
                        if ( sizeof( $rows ) > 0 ) {
-                               $v_start = $t_filter['per_page'] * 
($f_page_number-1) +1;
+                               $v_start = $t_filter['per_page'] * 
(int)($f_page_number-1) +1;
                                $v_end   = $v_start + sizeof( $rows ) -1;
                        }
 
@@ -94,7 +94,7 @@
                <span class="small"> <?php
                        # -- Page number links --
 
-                       print_page_links( 'view_all_bug_page.php', 1, 
$t_page_count, $f_page_number );
+                       print_page_links( 'view_all_bug_page.php', 1, 
$t_page_count, (int)$f_page_number );
                ?> </span>
        </td>
 </tr>
@@ -180,7 +180,7 @@
                <?php # -- Page number links -- ?>
                <td class="right" colspan="2">
                        <span class="small">
-                               <?php print_page_links( 
'view_all_bug_page.php', 1, $t_page_count, $f_page_number ) ?>
+                               <?php print_page_links( 
'view_all_bug_page.php', 1, $t_page_count, (int)$f_page_number ) ?>
                        </span>
                </td>
        </tr>

Index: my_view_page.php
===================================================================
RCS file: /cvsroot/mantisbt/mantisbt/my_view_page.php,v
retrieving revision 1.12
retrieving revision 1.12.8.1
diff -u -d -r1.12 -r1.12.8.1
--- my_view_page.php    7 Aug 2005 13:42:04 -0000       1.12
+++ my_view_page.php    24 Jan 2006 04:10:44 -0000      1.12.8.1
@@ -12,6 +12,8 @@
 <?php
        require_once( 'core.php' );
 
+       $t_core_path = config_get( 'core_path' );
+
        require_once( $t_core_path . 'compress_api.php' );
        require_once( $t_core_path . 'filter_api.php' );
 



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642