[SS-2017-008] Fix SQL injection in search engine

2017-11-21 15:34:59 +00:00 · 2017-11-21 15:34:59 +00:00 · ee356b1ad7
parent e3bebfe453
commit ee356b1ad7
1 changed files with 3 additions and 0 deletions
--- a/code/PostgreSQLDatabase.php
+++ b/code/PostgreSQLDatabase.php
@ -261,6 +261,9 @@ class PostgreSQLDatabase extends SS_Database {
 	 * @return object DataObjectSet of result pages
 	 */
 	public function searchEngine($classesToSearch, $keywords, $start, $pageLength, $sortBy = "ts_rank DESC", $extraFilter = "", $booleanSearch = false, $alternativeFileFilter = "", $invertedMatch = false) {
+		$start = (int)$start;
+		$pageLength = (int)$pageLength;
+
 		//Fix the keywords to be ts_query compatitble:
 		//Spaces must have pipes
 		//@TODO: properly handle boolean operators here.