Setting the page to be 0 (or a non-integer) in sfPropelPager switches off pagination which could lead to DOS attacks by manually typing URLs that bring back entire record sets.
Index: lib/addon/sfPager/sfPropelPager.class.php
===================================================================
--- lib/addon/sfPager/sfPropelPager.class.php (revision 1229)
+++ lib/addon/sfPager/sfPropelPager.class.php (working copy)
@@ -303,7 +303,9 @@
public function setPage($page)
{
- $this->page = ($page < 0) ? 1 : $page;
+ $page = intval($page);
+
+ $this->page = ($page <= 0) ? 1 : $page;
}
public function getMaxPerPage()
