From 75d3156dbfba9034943cbe54c861df957f394182 Mon Sep 17 00:00:00 2001
From: Stephane Chapron <schapron@centreon.com>
Date: Tue, 5 Jun 2018 13:33:00 +0200
Subject: [PATCH] fix(sec): Fix SQL injection in Graph Template
---
www/include/views/graphTemplates/listGraphTemplates.php | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/www/include/views/graphTemplates/listGraphTemplates.php b/www/include/views/graphTemplates/listGraphTemplates.php
index c117018e85..ea700670ca 100644
--- a/www/include/views/graphTemplates/listGraphTemplates.php
+++ b/www/include/views/graphTemplates/listGraphTemplates.php
@@ -43,7 +43,7 @@ $SearchTool = null;
$search = '';
if (isset($_POST['searchGT']) && $_POST['searchGT']) {
$search = $_POST['searchGT'];
- $SearchTool = " WHERE name LIKE '%".$search."%'";
+ $SearchTool = " WHERE name LIKE '%" . $pearDB->escape($search) . "%'";
}
$res = $pearDB->query("SELECT COUNT(*) FROM giv_graphs_template".$SearchTool);
@@ -140,7 +140,7 @@ $o2 = $form->getElement('o2');
$o2->setValue(null);
$tpl->assign('limit', $limit);
-$tpl->assign('searchGT', $search);
+$tpl->assign('searchGT', htmlentities($search));
/*
* Apply a template definition
--
GitLab