fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PMCORE-2324 SQL Injection via 'Category' parameter in proxyNewCasesList endpoint

Browse Source
This commit is contained in:
Roly Rudy Gutierrez Pinto
2020-10-15 19:48:15 -04:00
parent 6942e304da
commit 8a306f38d4
23 changed files with 589 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
workflow/engine/classes/model/ListCanceled.php
View File

@@ -254,7 +254,7 @@ class ListCanceled extends BaseListCanceled implements ListInterface
$criteria->addSelectColumn(ProcessPeer::PRO_CATEGORY);
$aConditions = array();
$aConditions[] = array(ListCanceledPeer::PRO_UID, ProcessPeer::PRO_UID);
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'" . $category . "'");
$aConditions[] = array(ProcessPeer::PRO_CATEGORY, "'" . G::realEscapeString($category) . "'");
$criteria->addJoinMC($aConditions, Criteria::INNER_JOIN);
}