Bug #34781: t3lib_userauth->getAuthInfoArray calls TYPO3_DB->cleanIntList without string parameter - TYPO3 Core - TYPO3 Forge

Actions

Copy link

Bug #34781

closed

t3lib_userauth->getAuthInfoArray calls TYPO3_DB->cleanIntList without string parameter

Added by Christian Finkemeier about 12 years ago. Updated over 9 years ago.

Status:

Closed

Priority:

Must have

Assignee:

Category:

Target version:

Start date:

2012-03-13

Due date:

% Done:

Estimated time:

TYPO3 Version:

4.5

PHP Version:

5.3

Tags:

Complexity:

easy

Is Regression:

Sprint Focus:

Description

The same problem as i described in this bug: http://forge.typo3.org/issues/34780

The t3lib_userauth->getAuthInfoArray calls TYPO3_DB->cleanIntList without parameter being string...

Should be updated to something like this:

t3lib/class.t3lib_userauth.php: line 1282
$authInfo['db_user']['check_pid_clause'] = $this->checkPid ? ' AND pid IN ('.$GLOBALS['TYPO3_DB']->cleanIntList((string)$authInfo['db_user']['checkPidList']).')' : '';

Related issues 1 (0 open — 1 closed)

Actions

Copy link

Updated by Oliver Hader about 12 years ago

Status changed from New to Accepted

Actions

Copy link

Updated by Christian Finkemeier over 9 years ago

This issue is not patched already in TYPO3 4.5.39 (i don't know, if it has been patched in newer major versions).

File t3lib/class.t3lib_userauth.php had to be changed like this (line 1298-1299):

$authInfo['db_user']['checkPidList'] = $this->checkPid ? $this->checkPid_value : '';
$authInfo['db_user']['check_pid_clause'] = $this->checkPid ? ' AND pid IN (' . $GLOBALS['TYPO3_DB']->cleanIntList($authInfo['db_user']['checkPidList']) . ')' : '';

if ($this->checkPid && ($this->checkPid_value || $this->checkPid_value === '0')) {
    $authInfo['db_user']['checkPidList'] = $this->checkPid_value;
    $authInfo['db_user']['check_pid_clause'] = ' AND pid IN (' . $GLOBALS['TYPO3_DB']->cleanIntList($authInfo['db_user']['checkPidList']) . ')';
} else {
    $authInfo['db_user']['checkPidList'] = '';
    $authInfo['db_user']['check_pid_clause'] = '';
}

Actions

Copy link