Skip to:
Content

bbPress.org

Opened 9 years ago

Closed 9 years ago

Last modified 9 years ago

#3148 closed defect (bug) (fixed)

Convertor: Validate the received value for 'Rows Limit"

Reported by: jrf Owned by: johnjamesjacoby
Priority: high Milestone: 2.5.14
Component: API - Importers Version: 2.5
Severity: normal Keywords: has-patch
Cc: johnjamesjacoby, jrf

Description

According to the HTML, the row limit is supported to be between 1 and 5000.
Currently this value was not being validated, so negative values or very high values could be passed via a script or when a browser would disregard the min/max as indicated in the HTML.

As a best practice, input should be validated server side anyway.

This minor change adds the necessary validation and ensures that the value is always between 1 and 5000.

Attachments (1)

trac-3148-validate-min-max-rows.patch​ (513 bytes ) - added by jrf 9 years ago.

Download all attachments as: .zip

Change History (4)

#1 @johnjamesjacoby
9 years ago

In 6661:

Converter: bind number-of-rows attribute to between 1 and 5000.

This change adds validation to ensure no unexpected number of database rows are queried.

Trunk, for 2.6. Props jrf. See #3148.

#2 @johnjamesjacoby
9 years ago

  • Owner set to johnjamesjacoby
  • Resolution → fixed
  • Status new → closed

In 6662:

Converter: bind number-of-rows attribute to between 1 and 5000.

This change adds validation to ensure no unexpected number of database rows are queried, and also back-ports sanitization to database connection values from trunk.

2.5 branch, for 2.5.14. Props jrf. Fixes #3148.

#3 @johnjamesjacoby
9 years ago

  • Milestone Awaiting Review → 2.5.14
  • Priority normal → high
  • Version trunk → 2.5
Note: See TracTickets for help on using tickets.