Closed q2apro closed 2 years ago
Thanks for the fix / rewrite!
So we can check by ctype_digit($blobid)
?
I simply thought of filtering the incoming value with preg_replace('/[^0-9]/', '', $blobid)
. Are there any disadvantages doing it this way? (Despite the fact that you could add other chars to the blobid in the URL and it would still display the correct image.)
You don't really need a replace. Just rejecting a match
should be enough. Any replace you do will make things slower, and not necessarily better (more accurate). However, even if you had done a simple match and reject the non-matching results, still it should be slower because it is a regex. I haven't tested this in detail but, most likely, the ctype_digit()
function should be faster.
Got a hack bot trying various things on my q2a installation.
One issue I noticed from the error log:
In qa-include/qa-image.php
I am pretty sure we should make sure that the incoming blobid is alphanumeric only.