summaryrefslogtreecommitdiffstats
path: root/editusers.cgi
diff options
context:
space:
mode:
Diffstat (limited to 'editusers.cgi')
-rwxr-xr-xeditusers.cgi5
1 files changed, 4 insertions, 1 deletions
diff --git a/editusers.cgi b/editusers.cgi
index 3e4a20e3b..a2a6ee51b 100755
--- a/editusers.cgi
+++ b/editusers.cgi
@@ -742,12 +742,14 @@ if ($action eq 'update') {
foreach (keys %::FORM) {
next unless /^bit_/;
#print "$_=$::FORM{$_}<br>\n";
+ detaint_natural($::FORM{$_}) || die "Groupset field tampered with";
$groupset .= " + $::FORM{$_}";
}
my $blessgroupset = "0";
foreach (keys %::FORM) {
next unless /^blbit_/;
#print "$_=$::FORM{$_}<br>\n";
+ detaint_natural($::FORM{$_}) || die "Blessgroupset field tampered with";
$blessgroupset .= " + $::FORM{$_}";
}
@@ -767,7 +769,8 @@ if ($action eq 'update') {
} else {
SendSQL("UPDATE profiles
SET groupset =
- groupset - (groupset & $opblessgroupset) + $groupset
+ groupset - (groupset & $opblessgroupset) +
+ (($groupset) & $opblessgroupset)
WHERE login_name=" . SqlQuote($userold));
# I'm paranoid that someone who I give the ability to bless people