Fix moderate-high security flaw - see #7242

ywarnier · ywarnier · commit 8a75f654066e · 2014-08-26T08:38:23.000-05:00
diff --git a/main/inc/lib/usermanager.lib.php b/main/inc/lib/usermanager.lib.php
@@ -3824,7 +3824,7 @@ public static function getUsersFollowedByUser(
 
         $userConditions = '';
         if (!empty($userStatus)) {
-            $userConditions .= ' AND u.status = '.$userStatus;
+            $userConditions .= ' AND u.status = '.intval($userStatus);
         }
 
         $select = " SELECT DISTINCT u.user_id, u.username, u.lastname, u.firstname, u.email ";

Original file line number	Diff line number	Diff line change
`@@ -3824,7 +3824,7 @@ public static function getUsersFollowedByUser(`
`3824`	`3824`
`3825`	`3825`	`$userConditions = '';`
`3826`	`3826`	`if (!empty($userStatus)) {`
`3827`		`- $userConditions .= ' AND u.status = '.$userStatus;`
	`3827`	`+ $userConditions .= ' AND u.status = '.intval($userStatus);`
`3828`	`3828`	`}`
`3829`	`3829`
`3830`	`3830`	`$select = " SELECT DISTINCT u.user_id, u.username, u.lastname, u.firstname, u.email ";`