Force the setupId to be an int in MFAuthenticationForm

diff --git a/wcfsetup/install/files/lib/form/MultifactorAuthenticationForm.class.php b/wcfsetup/install/files/lib/form/MultifactorAuthenticationForm.class.php
index de400ac9bfa101d7b30778084bb36a05b591c43c..d9483ffb72e6173e1cb28eca325aacec83176c0c 100644 (file)
--- a/wcfsetup/install/files/lib/form/MultifactorAuthenticationForm.class.php
+++ b/wcfsetup/install/files/lib/form/MultifactorAuthenticationForm.class.php
@@ -75,7 +75,7 @@ class MultifactorAuthenticationForm extends AbstractFormBuilderForm {
                
                $setupId = \array_keys($this->setups)[0];
                if (isset($_GET['id'])) {
-                       $setupId = $_GET['id'];
+                       $setupId = intval($_GET['id']);
                }
                
                if (!isset($this->setups[$setupId])) {