Update

WWBN · Jul 13, 2024 · 076add5 · 076add5
1 parent a31c52e
commit 076add5
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/objects/Object.php b/objects/Object.php
@@ -167,6 +167,13 @@ public static function getSqlOrderByFromPost($keyPrefix = "")
             }
         }
 
+        // add a security here
+        if (!empty($_GET['sort'])) {
+            foreach ($_GET['sort'] as $key => $value) {
+                $_GET['sort'][xss_esc($key)] = xss_esc($value);
+            }
+        }
+
         if (!empty($_POST['sort'])) {
             $orderBy = [];
             foreach ($_POST['sort'] as $key => $value) {