X-Git-Url: http://erislabs.net/gitweb/?a=blobdiff_plain;ds=sidebyside;f=source%2Fmircoders%2Fservlet%2FServletModuleContent.java;h=afba80cda6031526fb7193ecc61a16d6b66dd47b;hb=c144ff544fcae88787144d7f370108de1a941a41;hp=d09fd7f7960801bcc4364b8c530087704edd4fea;hpb=95c2e3a74f492f6f61d4dbe8bb47996f43af0627;p=mir.git

diff --git a/source/mircoders/servlet/ServletModuleContent.java b/source/mircoders/servlet/ServletModuleContent.java
index d09fd7f7..afba80cd 100755
--- a/source/mircoders/servlet/ServletModuleContent.java
+++ b/source/mircoders/servlet/ServletModuleContent.java
@@ -30,33 +30,16 @@
 
 package mircoders.servlet;
 
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.GregorianCalendar;
-import java.util.HashMap;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Locale;
-import java.util.Map;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
 import mir.entity.adapter.EntityAdapter;
-import mir.entity.adapter.EntityAdapterModel;
-import mir.entity.adapter.EntityIteratorAdapter;
 import mir.entity.adapter.EntityAdapterEngine;
+import mir.entity.adapter.EntityAdapterModel;
 import mir.generator.Generator;
 import mir.log.LoggerWrapper;
 import mir.misc.StringUtil;
 import mir.servlet.ServletModule;
 import mir.servlet.ServletModuleExc;
 import mir.servlet.ServletModuleFailure;
-import mir.util.HTTPRequestParser;
-import mir.util.JDBCStringRoutines;
-import mir.util.SQLQueryBuilder;
-import mir.util.StringRoutines;
-import mir.util.URLBuilder;
+import mir.util.*;
 import mircoders.entity.EntityContent;
 import mircoders.entity.EntityUsers;
 import mircoders.global.MirGlobal;
@@ -64,6 +47,10 @@ import mircoders.module.ModuleContent;
 import mircoders.storage.DatabaseContent;
 import mircoders.storage.DatabaseContentToTopics;
 
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.util.*;
+
 /**
  * Article admin interface code
  */
@@ -189,10 +176,19 @@ public class ServletModuleContent extends ServletModule {
   public void attach(HttpServletRequest aRequest, HttpServletResponse aResponse) throws ServletModuleExc {
     String  mediaIdParam = aRequest.getParameter("mid");
     String  articleId = aRequest.getParameter("articleid");
-
     if (articleId == null || mediaIdParam==null)
       throw new ServletModuleExc("smod content :: attach :: articleid/mid missing");
-
+    // check if mediaIdParam and articleid are correct integers
+    try
+    {
+      Integer.parseInt(mediaIdParam);
+      Integer.parseInt(articleId);
+    }
+    catch(NumberFormatException e)
+    {
+      throw new ServletModuleExc("smod content :: attach :: invalid articleid/mid");
+    }
+    
     if (!MirGlobal.accessControl().article().mayEditArticle(ServletHelper.getUser(aRequest), articleId))
       throw new ServletModuleExc("Article has been locked");
 
@@ -484,7 +480,7 @@ public class ServletModuleContent extends ServletModule {
       if (articleId == null)
         throw new ServletModuleExc("ServletModuleContent.listchildren: article_id not set!");
 
-      returnList(aRequest, aResponse, "to_content = " + articleId, "webdb_create desc", 0, null);
+      returnList(aRequest, aResponse, "to_content = " + articleId, "webdb_create desc", 0);
     }
     catch (Throwable e) {
       throw new ServletModuleFailure(e);