diff --git a/index.php b/index.php index 7210c71..07470a0 100644 --- a/index.php +++ b/index.php @@ -1330,10 +1330,17 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history) die('Wrong token.'); } - if (strpos($_GET['lf_linkdate'], ' ') !== false) { - $ids = array_values(array_filter(preg_split('/\s+/', escape($_GET['lf_linkdate'])))); + $ids = trim($_GET['lf_linkdate']); + if (strpos($ids, ' ') !== false) { + // multiple, space-separated ids provided + $ids = array_values(array_filter(preg_split('/\s+/', escape($ids)))); } else { - $ids = [$_GET['lf_linkdate']]; + // only a single id provided + $ids = [$ids]; + } + // assert at least one id is given + if(!count($ids)){ + die('no id provided'); } foreach ($ids as $id) { $id = (int) escape($id); diff --git a/tpl/default/js/shaarli.js b/tpl/default/js/shaarli.js index 4f49aff..f38ba62 100644 --- a/tpl/default/js/shaarli.js +++ b/tpl/default/js/shaarli.js @@ -401,14 +401,14 @@ window.onload = function () { var message = 'Are you sure you want to delete '+ links.length +' links?\n'; message += 'This action is IRREVERSIBLE!\n\nTitles:\n'; - var ids = ''; + var ids = []; links.forEach(function(item) { message += ' - '+ item['title'] +'\n'; - ids += item['id'] +'+'; + ids.push(item['id']); }); if (window.confirm(message)) { - window.location = '?delete_link&lf_linkdate='+ ids +'&token='+ token.value; + window.location = '?delete_link&lf_linkdate='+ ids.join('+') +'&token='+ token.value; } }); }