fernando/luos
1
0
Fork 0
Code Releases Activity

HOR-281 Sanitizes output for storeInTmp method in genericAjax.

Browse Source
This commit is contained in:
Chloe Deguzman
2016-03-04 10:40:40 +00:00
parent 591d4f59c4
commit 6f57980ef9
1 changed files with 24 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
gulliver/methods/genericAjax.php
View File

@@ -171,10 +171,22 @@ if( isset($request) ){
case 'storeInTmp':
if(!isset($_SESSION['USER_LOGGED'])) {
echo "{status: 0, message: \"Not Authorized\"}";
break;
}
try {
$con = Propel::getConnection($_GET['cnn']);
if($_GET['pkt'] == 'int'){
$rs = $con->executeQuery("SELECT MAX({$_GET['pk']}) as lastId FROM {$_GET['table']};");
// I know this isn't perfect
// but this is the sanitization
// that's used by Creole.
$primaryKeyField = mysql_real_escape_string($_GET['pk']);
$tableName = mysql_real_escape_string($_GET['table']);
$primaryKeyField = str_replace("`", "", $primaryKeyField);
$tableName = str_replace("`", "", $tableName);
$rs = $con->executeQuery("SELECT MAX(`$primaryKeyField`) as lastId FROM `$tableName`");
$rs->next();
$row = $rs->getRow();
$gKey = (int)$row['lastId'] + 1;
@@ -182,15 +194,24 @@ if( isset($request) ){
} else {
$gKey = G::encryptOld(date('Y-m-d H:i:s').'@'.rand());
}
// See above. Gross, but it works.
$field = mysql_real_escape_string($_GET['fld']);
$field = str_replace("`", "", $field);
$query = "INSERT INTO {$_GET['table']} ({$_GET['pk']}, {$_GET['fld']}) VALUES (?, ?)"; // '$gKey', '{$_GET['value']}')";
$rs = $con->executeQuery("INSERT INTO {$_GET['table']} ({$_GET['pk']}, {$_GET['fld']}) VALUES ('$gKey', '{$_GET['value']}');");
$rs = $con->prepareStatement($query);
$rs->set(1, $gKey);
$rs->set(2, $_GET['value']);
$rs->executeQuery();
echo "{status: 1, message: \"success\"}";
} catch (Exception $e) {
$err = $e->getMessage();
//$err = eregi_replace("[\n|\r|\n\r]", ' ', $err);
$err = preg_replace("[\n|\r|\n\r]", " ", $err); //Made compatible to PHP 5.3
echo $con->lastQuery;
echo "{status: 0, message: \"" . $err . "\"}";
}
break;