Update of /cvsroot/frontaccounting/frontaccount/admin/db
In directory sfp-cvsdas-3.v30.ch3.sourceforge.com:/tmp/cvs-serv22747
Modified Files:
Tag: unstable
security_db.inc
Log Message:
Fixed vulnerability on id paramater
Index: security_db.inc
===================================================================
RCS file: /cvsroot/frontaccounting/frontaccount/admin/db/security_db.inc,v
retrieving revision 1.1.2.2
retrieving revision 1.1.2.3
diff -C2 -d -r1.1.2.2 -r1.1.2.3
*** security_db.inc 31 Aug 2009 13:45:43 -0000 1.1.2.2
--- security_db.inc 26 Nov 2010 10:09:40 -0000 1.1.2.3
***************
*** 14,18 ****
function get_security_role($id)
{
! $sql = "SELECT * FROM ".TB_PREF."security_roles WHERE id='$id'";
$ret = db_query($sql, "could not retrieve security roles");
$row = db_fetch($ret);
--- 14,18 ----
function get_security_role($id)
{
! $sql = "SELECT * FROM ".TB_PREF."security_roles WHERE id=".(int)$id;
$ret = db_query($sql, "could not retrieve security roles");
$row = db_fetch($ret);
***************
*** 46,50 ****
.",sections=".db_escape(implode(';', $sections))
.",areas=".db_escape(implode(';', $areas))
! ." WHERE id=$id";
db_query($sql, "could not update role");
}
--- 46,50 ----
.",sections=".db_escape(implode(';', $sections))
.",areas=".db_escape(implode(';', $areas))
! ." WHERE id=".(int)$id;
db_query($sql, "could not update role");
}
***************
*** 53,57 ****
function delete_security_role($id)
{
! $sql = "DELETE FROM ".TB_PREF."security_roles WHERE id=$id";
db_query($sql, "could not delete role");
--- 53,57 ----
function delete_security_role($id)
{
! $sql = "DELETE FROM ".TB_PREF."security_roles WHERE id=".(int)$id;
db_query($sql, "could not delete role");
***************
*** 60,64 ****
function check_role_used($id) {
! $sql = "SELECT count(*) FROM ".TB_PREF."users WHERE role_id=$id";
$ret = db_query($sql, 'cannot check role usage');
$row = db_fetch($ret);
--- 60,64 ----
function check_role_used($id) {
! $sql = "SELECT count(*) FROM ".TB_PREF."users WHERE role_id=".(int)$id;
$ret = db_query($sql, 'cannot check role usage');
$row = db_fetch($ret);
|