From 6f57980ef9e6addc09201d4bae1b8a8f2bb0bb95 Mon Sep 17 00:00:00 2001
From: Chloe Deguzman <chloe.deguzman@processmaker.com>
Date: Fri, 4 Mar 2016 10:40:40 +0000
Subject: [PATCH] HOR-281 Sanitizes output for storeInTmp method in
 genericAjax.

---
 gulliver/methods/genericAjax.php | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/gulliver/methods/genericAjax.php b/gulliver/methods/genericAjax.php
index 4fef38877..3317d58b8 100755
--- a/gulliver/methods/genericAjax.php
+++ b/gulliver/methods/genericAjax.php
@@ -171,10 +171,22 @@ if( isset($request) ){
 
 
     case 'storeInTmp':
+        if(!isset($_SESSION['USER_LOGGED'])) { 
+            echo "{status: 0, message: \"Not Authorized\"}";
+            break;
+        }
       try {
         $con = Propel::getConnection($_GET['cnn']);
         if($_GET['pkt'] == 'int'){
-          $rs = $con->executeQuery("SELECT MAX({$_GET['pk']}) as lastId FROM {$_GET['table']};");
+          // I know this isn't perfect
+          // but this is the sanitization 
+          // that's used by Creole.
+
+          $primaryKeyField = mysql_real_escape_string($_GET['pk']);
+          $tableName = mysql_real_escape_string($_GET['table']);
+          $primaryKeyField = str_replace("`", "", $primaryKeyField);
+          $tableName = str_replace("`", "", $tableName);
+          $rs = $con->executeQuery("SELECT MAX(`$primaryKeyField`) as lastId FROM `$tableName`");
           $rs->next();
           $row = $rs->getRow();
           $gKey = (int)$row['lastId'] + 1;
@@ -182,15 +194,24 @@ if( isset($request) ){
         } else {
           $gKey = G::encryptOld(date('Y-m-d H:i:s').'@'.rand());
         }
+        
+        // See above. Gross, but it works. 
+        $field = mysql_real_escape_string($_GET['fld']);
+        $field = str_replace("`", "", $field);
+        
+        $query = "INSERT INTO {$_GET['table']} ({$_GET['pk']}, {$_GET['fld']}) VALUES (?, ?)"; // '$gKey', '{$_GET['value']}')";
 
-        $rs = $con->executeQuery("INSERT INTO {$_GET['table']} ({$_GET['pk']}, {$_GET['fld']}) VALUES ('$gKey', '{$_GET['value']}');");
+        $rs = $con->prepareStatement($query);
+        $rs->set(1, $gKey);
+        $rs->set(2, $_GET['value']);
+        $rs->executeQuery();
 
         echo "{status: 1, message: \"success\"}";
       } catch (Exception $e) {
         $err = $e->getMessage();
         //$err = eregi_replace("[\n|\r|\n\r]", ' ', $err);
         $err = preg_replace("[\n|\r|\n\r]", " ", $err); //Made compatible to PHP 5.3
-
+        echo $con->lastQuery;
         echo "{status: 0, message: \"" . $err . "\"}";
       }
       break;