fix: Sanitise integer query parameters (#3064)

flarum · Sep 17, 2021 · c1a8c6c · c1a8c6c
1 parent c10a30b
commit c1a8c6c
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/Api/Controller/AbstractSerializeController.php b/src/Api/Controller/AbstractSerializeController.php
@@ -236,7 +236,7 @@ protected function extractSort(ServerRequestInterface $request)
      */
     protected function extractOffset(ServerRequestInterface $request)
     {
-        return $this->buildParameters($request)->getOffset($this->extractLimit($request)) ?: 0;
+        return (int) $this->buildParameters($request)->getOffset($this->extractLimit($request)) ?: 0;
     }
 
     /**
@@ -245,7 +245,7 @@ protected function extractOffset(ServerRequestInterface $request)
      */
     protected function extractLimit(ServerRequestInterface $request)
     {
-        return $this->buildParameters($request)->getLimit($this->maxLimit) ?: $this->limit;
+        return (int) $this->buildParameters($request)->getLimit($this->maxLimit) ?: $this->limit;
     }
 
     /**