Fix bind_param type mismatches and integer validation

- TemplateModel.php: fix bind_param "ssssiii" -> "sssssii" (5 strings not 4)
- manage_workflows.php: fix bind_param 'ssiiii' -> 'ssiiiii' (4 int columns)
- download_attachment.php, delete_attachment.php, get_template.php: replace is_numeric()
  with strict int cast+equality check to reject floats and scientific notation
- manage_recurring.php: validate JSON input before accessing schedule_type key

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
2026-03-28 22:33:48 -04:00
parent 5242d42fa7
commit cfbef029cb
6 changed files with 16 additions and 15 deletions
+1 -1
View File
@@ -87,7 +87,7 @@ class TemplateModel {
default_priority = ?
WHERE template_id = ?";
$stmt = $this->conn->prepare($sql);
$stmt->bind_param("ssssiii",
$stmt->bind_param("sssssii",
$data['template_name'],
$data['title_template'],
$data['description_template'],