Welcome to mirror list, hosted at ThFree Co, Russian Federation.

github.com/matomo-org/matomo.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
path: root/core
diff options
context:
space:
mode:
authorThomas Steur <tsteur@users.noreply.github.com>2019-05-06 00:20:41 +0300
committerGitHub <noreply@github.com>2019-05-06 00:20:41 +0300
commitc316594c47c0b52a79f1177dbecf55ef532d64c9 (patch)
tree887169649fa8b3e68a85ead08f15481101ac2e5a /core
parent36bfbcf6023cfcddee91e9f8050fb0e3e7e45d9b (diff)
Fix build for failing integration test purger (#14407)
I added a ctype_xdigit test to 100% prevent injections but then noticed the tests use also some other letters. Could restrict the preg_match to `a-f` but using `A-Z` makes the tests a bit more readable and is as safe
Diffstat (limited to 'core')
-rw-r--r--core/DataAccess/Model.php2
1 files changed, 1 insertions, 1 deletions
diff --git a/core/DataAccess/Model.php b/core/DataAccess/Model.php
index fe8c26d598..0af2b2252b 100644
--- a/core/DataAccess/Model.php
+++ b/core/DataAccess/Model.php
@@ -368,7 +368,7 @@ class Model
// segments are md5 hashes and such not a problem re sql injection. for performance etc we don't want to use
// bound parameters for the query
foreach ($segments as $segment) {
- if (!ctype_xdigit($segment)) {
+ if (!preg_match('/^[a-z0-9A-Z]+$/', $segment)) {
throw new Exception($segment . ' expected to be an md5 hash');
}
}