From 01c0d15118589d9a5018536d66f8f6c566edf32b Mon Sep 17 00:00:00 2001
From: Stephane Chapron <schapron@centreon.com>
Date: Tue, 5 Jun 2018 13:38:07 +0200
Subject: [PATCH] Fix SQL injection in VirtualMetrics Template
---
www/include/views/virtualMetrics/listVirtualMetrics.php | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/www/include/views/virtualMetrics/listVirtualMetrics.php b/www/include/views/virtualMetrics/listVirtualMetrics.php
index 54f87f9fb6..42d0062619 100644
--- a/www/include/views/virtualMetrics/listVirtualMetrics.php
+++ b/www/include/views/virtualMetrics/listVirtualMetrics.php
@@ -43,7 +43,7 @@ $SearchTool = null;
$search = '';
if (isset($_POST['searchVM']) && $_POST['searchVM']) {
$search = $_POST['searchVM'];
- $SearchTool = " WHERE vmetric_name LIKE '%".$search."%'";
+ $SearchTool = " WHERE vmetric_name LIKE '%" . $pearDB->escape($search) . "%'";
}
$DBRESULT = $pearDB->query("SELECT COUNT(*) FROM virtual_metrics".$SearchTool);
@@ -179,7 +179,7 @@ $form->setDefaults(array('o2' => null));
$o2 = $form->getElement('o2');
$o2->setValue(null);
$tpl->assign('limit', $limit);
-$tpl->assign('searchVM', $search);
+$tpl->assign('searchVM', htmlentities($search));
/*
* Apply a template definition
--
GitLab