Changeset 2706797 for photo-gallery/trunk/frontend/models

Timestamp:

04/08/2022 06:40:12 AM (3 years ago)

Author:

10web

Message:

• Improved: Storable sort order in filemanager.
• Improved: Storable sort order in list views.
• Fixed: SQL Injection.
• Fixed: Cross-Site Scripting.
• Fixed: Slideshow responsiveness.
• Fixed: Add tag functionality on PHP 8.
• Fixed: Open gallery in new tab from gallery group.
• Fixed: Thumbnails alignment with enabled images titles.

File:

• photo-gallery/trunk/frontend/models/BWGModelGalleryBox.php (modified) (2 diffs)

photo-gallery/trunk/frontend/models/BWGModelGalleryBox.php

@@ -43 +43 @@
       $bwg_filter_tag_temp = WDWLibrary::get('filter_tag_' . $bwg, 0);
       if ( !empty($bwg_filter_tag_temp) ) {
-        $filter_tags = explode(",", $bwg_filter_tag_temp);
+        $filter_tags = array_map('intval', explode(",", $bwg_filter_tag_temp));
       }
     }
     else {
-      $filter_tags = explode(",", $bwg_filter_tag_temp);
+      $filter_tags = array_map('intval', explode(",", $bwg_filter_tag_temp));
     }
 
@@ -111 +111 @@
           $join .= ' LEFT JOIN (SELECT GROUP_CONCAT(tag_id order by tag_id SEPARATOR ",") AS tags_combined, image_id FROM  ' . $wpdb->prefix . 'bwg_image_tag GROUP BY image_id) AS tags ON image.id=tags.image_id';
       }
-      $where .= ' AND CONCAT(",", tags.tags_combined, ",") REGEXP ",(' . implode($compare_sign, $filter_tags) . ')," ';
+      $where .= ' AND CONCAT(",", tags.tags_combined, ",") REGEXP ",( %s )," ';
+      $prepareArgs[] = implode($compare_sign, $filter_tags);
     }