Merge pull request #1 from mybuilder/fix-security-issue

Fix potential SQL injection issue
mybuilder · Feb 21, 2018 · c393e15 · c393e15
2 parents b99e1c0 + 181de40
commit c393e15
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/runtime/lib/adapter/DBPostgres.php b/runtime/lib/adapter/DBPostgres.php
@@ -142,6 +142,9 @@ public function getTimeFormatter()
      */
     public function applyLimit(&$sql, $offset, $limit)
     {
+        $offset = (int) $offset;
+        $limit = (int) $limit;
+
         if ($limit > 0) {
             $sql .= " LIMIT ".$limit;
         }

diff --git a/runtime/lib/query/Criteria.php b/runtime/lib/query/Criteria.php
@@ -1178,8 +1178,7 @@ public function isSingleRecord()
      */
     public function setLimit($limit)
     {
-        // TODO: do we enforce int here? 32bit issue if we do
-        $this->limit = $limit;
+        $this->limit = (int) $limit;
 
         return $this;
     }