diff options
| author | Thomas Pulzer <t.pulzer@kniel.de> | 2016-07-06 11:31:28 +0200 |
|---|---|---|
| committer | Thomas Pulzer <t.pulzer@kniel.de> | 2016-07-06 11:31:28 +0200 |
| commit | 0638937ada237f6bd05620dfb16cfa17c6b971b7 (patch) | |
| tree | 1cc2cbdc78912138964af0f62bdcd030f165b86c /lib/private/Setup/PostgreSQL.php | |
| parent | d367318088c2044427a574b1e42c48deade1bec3 (diff) | |
| download | nextcloud-server-0638937ada237f6bd05620dfb16cfa17c6b971b7.tar.gz nextcloud-server-0638937ada237f6bd05620dfb16cfa17c6b971b7.zip | |
Changed the input option for database-port to required when parameter was provided.
Added casting database port to int for input sanitation in pgsql and oci connections.
Diffstat (limited to 'lib/private/Setup/PostgreSQL.php')
| -rw-r--r-- | lib/private/Setup/PostgreSQL.php | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/private/Setup/PostgreSQL.php b/lib/private/Setup/PostgreSQL.php index 35d8b8eac14..464d1e02e21 100644 --- a/lib/private/Setup/PostgreSQL.php +++ b/lib/private/Setup/PostgreSQL.php @@ -36,8 +36,8 @@ class PostgreSQL extends AbstractDatabase { // adding port support through installer if(!empty($this->dbPort)) { - // adding slashes for security reasons - $port = addslashes($this->dbPort); + // casting to int to avoid malicious input + $port = (int)$this->dbPort; } else if(strpos($e_host, ':')) { list($e_host, $port)=explode(':', $e_host, 2); } else { |