Looking at ACP->adminLog() specifically, $log_days, which could be anything. There is no enforcement when saving to Config the Store Settings.
Thus, should the value of r_admin_activity be something like "Foo", nothing happens.
This is the legend: "Log Retention (Leave empty to disable retention)".
Suggest that an integer value be enforced when processing the configuration settings in settings.index.inc.php.
Also suggest that there be a single test for retention, for whether to delete old records. Have DB->insert() placed just after $log_days = Config, so that it happens regardless.
The other admin logging code could be checked, as well.
Looking at
ACP->adminLog()
specifically,$log_days
, which could be anything. There is no enforcement when saving to Config the Store Settings.Thus, should the value of
r_admin_activity
be something like "Foo", nothing happens.This is the legend: "Log Retention (Leave empty to disable retention)".
Suggest that an integer value be enforced when processing the configuration settings in settings.index.inc.php.
Also suggest that there be a single test for retention, for whether to delete old records. Have DB->insert() placed just after
$log_days = Config
, so that it happens regardless.The other admin logging code could be checked, as well.