Private GIT

Skip to content
Snippets Groups Projects
Commit 810092ae authored by Maximilien Bersoult's avatar Maximilien Bersoult Committed by Stephane Chapron
Browse files

fix(sec): Fix SQL injection in Curve template 

* Fix SQL injection in curve template search field
parent 7080bf93
Branches
Tags
No related merge requests found
Show whitespace changes
Inline Side-by-side
www/include/views/componentTemplates/listComponentTemplates.php
+ 2
− 2
View file @ 810092ae
...@@ -43,7 +43,7 @@ $SearchTool = null; ...@@ -43,7 +43,7 @@ $SearchTool = null;
$search = ''; $search = '';
if (isset($_POST['searchCurve']) && $_POST['searchCurve']) { if (isset($_POST['searchCurve']) && $_POST['searchCurve']) {
$search = $_POST['searchCurve']; $search = $_POST['searchCurve'];
$SearchTool = " WHERE name LIKE '%".$search."%'"; $SearchTool = " WHERE name LIKE '%" . $pearDB->escape($search) . "%'";
} }
$DBRESULT = $pearDB->query("SELECT COUNT(*) FROM giv_components_template".$SearchTool); $DBRESULT = $pearDB->query("SELECT COUNT(*) FROM giv_components_template".$SearchTool);
...@@ -163,7 +163,7 @@ $o2 = $form->getElement('o2'); ...@@ -163,7 +163,7 @@ $o2 = $form->getElement('o2');
$o2->setValue(null); $o2->setValue(null);
$tpl->assign('limit', $limit); $tpl->assign('limit', $limit);
$tpl->assign('searchCurve', $search); $tpl->assign('searchCurve', htmlentities($search));
/* /*
* Apply a template definition * Apply a template definition
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment

Another place to be (or not)