Add default value for search_users (path disclosure) - refs #2746

ywarnier · ywarnier · commit 15e49c1737b2 · 2018-12-03T14:03:24.000-05:00
diff --git a/main/admin/dashboard_add_users_to_user.php b/main/admin/dashboard_add_users_to_user.php
@@ -63,7 +63,7 @@
     api_not_allowed(true);
 }
 
-function search_users($needle, $type)
+function search_users($needle, $type = 'multiple')
 {
     global $tbl_access_url_rel_user, $tbl_user, $user_anonymous, $current_user_id, $user_id, $userStatus;
 
@@ -365,6 +365,7 @@ function remove_item(origin) {
 }
 
 $search_user = '';
+$needle = '';
 if (!empty($firstLetterUser)) {
     $needle = Database::escape_string($firstLetterUser);
     $search_user = "AND ".(api_sort_by_first_name() ? 'firstname' : 'lastname')." LIKE '$needle%'";

Original file line number	Diff line number	Diff line change
`@@ -63,7 +63,7 @@`
`63`	`63`	`api_not_allowed(true);`
`64`	`64`	`}`
`65`	`65`
`66`		`-function search_users($needle, $type)`
	`66`	`+function search_users($needle, $type = 'multiple')`
`67`	`67`	`{`
`68`	`68`	`global $tbl_access_url_rel_user, $tbl_user, $user_anonymous, $current_user_id, $user_id, $userStatus;`
`69`	`69`
`@@ -365,6 +365,7 @@ function remove_item(origin) {`
`365`	`365`	`}`
`366`	`366`
`367`	`367`	`$search_user = '';`
	`368`	`+$needle = '';`
`368`	`369`	`if (!empty($firstLetterUser)) {`
`369`	`370`	`$needle = Database::escape_string($firstLetterUser);`
`370`	`371`	`$search_user = "AND ".(api_sort_by_first_name() ? 'firstname' : 'lastname')." LIKE '$needle%'";`