Changes in [2706:c7f1c1418fbf:2710:f99841305743]

Files:

• .hgtags (modified) (1 diff)
• CHANGELOG (modified) (1 diff)
• admin/categories.php (modified) (1 diff)
• inc/core/class.dc.categories.php (modified) (1 diff)
• inc/core/class.dc.xmlrpc.php (modified) (1 diff)

.hgtags

@@ -18 +18 @@
 dc51785c0e18369445c71dfdc268c6034e61f681 2.6.0
 185f7650c1d86e4a5680c2d3b1da5628253091f5 2.6.1
+1f8978ee39fc70bf9a6c345cf3b550722b819173 2.6.2

CHANGELOG

@@ +1 @@
+Dotclear 2.6.2 - 2014-01-20
+===========================================================
+* Security fix: Fixed potential code injection on password protected post/page. Thanks to Charlie Briggs
+* Bugfix: cope with numeric module (plugin/theme) id
+* Bugfix: Bad SQL syntax when using SQLite
+* Bugfix: BlogParentThemeURL template value is back
+* Various bug fixes
+
 Dotclear 2.6.1 - 2013-11-22
 ===========================================================

admin/categories.php

@@ -73 +73 @@
 
      foreach ($categories as $category) {
-          if (!empty($category->item_id)) {
+          if (!empty($category->item_id) && !empty($category->left) && !empty($category->right)) {
                $core->blog->updCategoryPosition($category->item_id, $category->left, $category->right);
           }

inc/core/class.dc.categories.php

@@ -190 +190 @@
         public function updatePosition($id,$left,$right)
         {
+               $node_left = (integer) $left;
+               $node_right = (integer) $right;
+               $node_id = (integer) $id;
                 $sql = 'UPDATE '.$this->table.' SET '
-                        .$this->f_left.' = '.$left.', '
-                        .$this->f_right.' = '.$right
-                        .' WHERE '.$this->f_id .' = '.(integer) $id
+                        .$this->f_left.' = '.$node_left.', '
+                        .$this->f_right.' = '.$node_right
+                        .' WHERE '.$this->f_id .' = '.$node_id
                         .$this->getCondition();
 

inc/core/class.dc.xmlrpc.php

@@ -264 +264 @@
      private function setUser($user_id,$pwd)
      {
-          if ($this->core->auth->userID() == $user_id) {
-               return true;
-          }
-
-          if ($this->core->auth->checkUser($user_id,$pwd) !== true) {
+          if (empty($pwd) || $this->core->auth->checkUser($user_id,$pwd) !== true) {
                throw new Exception('Login error');
           }