Skip to content

Commit 35509d5

Browse files
author
Till Brehm
committed
Better variable quoting in sql queries.
1 parent e9a57d4 commit 35509d5

20 files changed

+57
-48
lines changed

‎interface/lib/classes/tform.inc.php‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1048,6 +1048,8 @@ function validateField($field_name, $field_value, $validators) {
10481048
function getSQL($record, $tab, $action = 'INSERT', $primary_id = 0, $sql_ext_where = '') {
10491049

10501050
global $app;
1051+
1052+
$primary_id = $app->functions->intval($primary_id);
10511053

10521054
// If there are no data records on the tab, return empty sql string
10531055
if(count($this->formDef['tabs'][$tab]['fields']) == 0) return '';
@@ -1272,6 +1274,7 @@ function showForm() {
12721274
function getDataRecord($primary_id) {
12731275
global $app;
12741276
$escape = '`';
1277+
$primary_id = $app->functions->intval($primary_id);
12751278
$sql = "SELECT * FROM ".$escape.$this->formDef['db_table'].$escape." WHERE ".$this->formDef['db_table_idx']." = ".$primary_id." AND ".$this->getAuthSQL('r', $this->formDef['db_table']);
12761279
return $app->db->queryOneRecord($sql);
12771280
}
@@ -1285,6 +1288,11 @@ function datalogSave($action, $primary_id, $record_old, $record_new) {
12851288
}
12861289

12871290
function getAuthSQL($perm, $table = '') {
1291+
global $app;
1292+
1293+
$perm = $app->db->quote($perm);
1294+
$table = $app->db->quote($table);
1295+
12881296
if($_SESSION["s"]["user"]["typ"] == 'admin') {
12891297
return '1';
12901298
} else {
@@ -1309,6 +1317,7 @@ function getAuthSQL($perm, $table = '') {
13091317
function checkPerm($record_id, $perm) {
13101318
global $app;
13111319

1320+
$record_id = $app->functions->intval($record_id);
13121321
if($record_id > 0) {
13131322
// Add backticks for incomplete table names.
13141323
if(stristr($this->formDef['db_table'], '.')) {
@@ -1403,7 +1412,7 @@ function checkClientLimit($limit_name, $sql_where = '') {
14031412
if($limit_name == '') $app->error('Limit name missing in function checkClientLimit.');
14041413

14051414
// Get the limits of the client that is currently logged in
1406-
$client_group_id = $_SESSION["s"]["user"]["default_group"];
1415+
$client_group_id = $app->functions->intval($_SESSION["s"]["user"]["default_group"]);
14071416
$client = $app->db->queryOneRecord("SELECT $limit_name as number, parent_client_id FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
14081417

14091418
// Check if the user may add another item
@@ -1425,7 +1434,7 @@ function checkResellerLimit($limit_name, $sql_where = '') {
14251434
if($limit_name == '') $app->error('Limit name missing in function checkClientLimit.');
14261435

14271436
// Get the limits of the client that is currently logged in
1428-
$client_group_id = $_SESSION["s"]["user"]["default_group"];
1437+
$client_group_id = $app->functions->intval($_SESSION["s"]["user"]["default_group"]);
14291438
$client = $app->db->queryOneRecord("SELECT parent_client_id FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
14301439

14311440
//* If the client belongs to a reseller, we will check against the reseller Limit too

‎interface/lib/classes/tform_actions.inc.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ function onSubmit() {
8181

8282
// check if the client is locked - he may not change anything, then.
8383
if(!$app->auth->is_admin()) {
84-
$client_group_id = $_SESSION["s"]["user"]["default_group"];
84+
$client_group_id = $app->functions->intval($_SESSION["s"]["user"]["default_group"]);
8585
$client = $app->db->queryOneRecord("SELECT client.locked FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = ".$app->functions->intval($client_group_id));
8686
if(is_array($client) && $client['locked'] == 'y') {
8787
$app->tform->errorMessage .= $app->lng("client_you_are_locked")."<br />";

‎interface/lib/classes/validate_client.inc.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ function username_unique($field_name, $field_value, $validator) {
5353
}
5454
}
5555
} else {
56-
$num_rec = $app->db->queryOneRecord("SELECT count(*) as number FROM sys_user WHERE username = '".$app->db->quote($field_value)."' AND client_id != ".$client_id);
56+
$num_rec = $app->db->queryOneRecord("SELECT count(*) as number FROM sys_user WHERE username = '".$app->db->quote($field_value)."' AND client_id != ".$app->functions->intval($client_id));
5757
if($num_rec["number"] > 0) {
5858
$errmsg = $validator['errmsg'];
5959
if(isset($app->tform->wordbook[$errmsg])) {

‎interface/lib/classes/validate_dns.inc.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ function validate_field($field, $area, $zoneid, $wildcard_allowed = 1){
104104
}
105105

106106
if(substr($field, -1) == '.' && $area == 'Name'){
107-
$soa = $app->db->queryOneRecord("SELECT * FROM soa WHERE id = ".$zoneid);
107+
$soa = $app->db->queryOneRecord("SELECT * FROM soa WHERE id = ".intval($zoneid));
108108
if(substr($field, (strlen($field) - strlen($soa['origin']))) != $soa['origin']) $error .= $desc." ".$app->tform->wordbook['error_out_of_zone']."<br>\r\n";
109109
}
110110

@@ -267,7 +267,7 @@ function increase_serial($serial){
267267
global $app, $conf;
268268

269269
// increase serial
270-
$serial_date = substr($serial, 0, 8);
270+
$serial_date = $app->functions->intval(substr($serial, 0, 8));
271271
$count = $app->functions->intval(substr($serial, 8, 2));
272272
$current_date = date("Ymd");
273273
if($serial_date >= $current_date){

‎interface/lib/classes/validate_domain.inc.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ function _check_unique($domain_name, $only_domain = false) {
118118

119119
if($domain['ip_address'] == '' || $domain['ipv6_address'] == ''){
120120
if($domain['parent_domain_id'] > 0){
121-
$parent_domain = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$domain['parent_domain_id']);
121+
$parent_domain = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$app->functions->intval($domain['parent_domain_id']));
122122
}
123123
}
124124

@@ -217,7 +217,7 @@ function _check_unique($domain_name, $only_domain = false) {
217217
// if alias/subdomain: check IP addresses of parent domain
218218
if($check['ip_address'] == '' || $check['ipv6_address'] == ''){
219219
if($check['parent_domain_id'] > 0){
220-
$check_parent_domain = $app->db->queryOneRecord("SELECT * FROM `web_domain` WHERE `domain_id` = ".$check['parent_domain_id']);
220+
$check_parent_domain = $app->db->queryOneRecord("SELECT * FROM `web_domain` WHERE `domain_id` = ".$app->functions->intval($check['parent_domain_id']));
221221
}
222222
}
223223

@@ -282,7 +282,7 @@ function _wildcard_limit() {
282282

283283
if($_SESSION["s"]["user"]["typ"] != 'admin') {
284284
// Get the limits of the client
285-
$client_group_id = $_SESSION["s"]["user"]["default_group"];
285+
$client_group_id = $app->functions->intval($_SESSION["s"]["user"]["default_group"]);
286286
$client = $app->db->queryOneRecord("SELECT limit_wildcard FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
287287

288288
if($client["limit_wildcard"] == 'y') return true;

‎interface/web/dns/dns_a_edit.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ function onShowNew() {
5757
if($_SESSION["s"]["user"]["typ"] == 'user') {
5858

5959
// Get the limits of the client
60-
$client_group_id = $_SESSION["s"]["user"]["default_group"];
60+
$client_group_id = intval($_SESSION["s"]["user"]["default_group"]);
6161
$client = $app->db->queryOneRecord("SELECT limit_dns_record FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
6262

6363
// Check if the user may add another mailbox.
@@ -84,7 +84,7 @@ function onSubmit() {
8484
// Check the client limits, if user is not the admin
8585
if($_SESSION["s"]["user"]["typ"] != 'admin') { // if user is not admin
8686
// Get the limits of the client
87-
$client_group_id = $_SESSION["s"]["user"]["default_group"];
87+
$client_group_id = intval($_SESSION["s"]["user"]["default_group"]);
8888
$client = $app->db->queryOneRecord("SELECT limit_dns_record FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
8989

9090
// Check if the user may add another mailbox.
@@ -97,7 +97,7 @@ function onSubmit() {
9797
} // end if user is not admin
9898

9999
//* Check for duplicates where IP and hostname are the same
100-
$tmp = $app->db->queryOneRecord("SELECT count(id) as number FROM dns_rr WHERE (type = 'A' AND name = '".$this->dataRecord["name"]."' AND zone = '".$this->dataRecord["zone"]."' and data = '".$this->dataRecord["data"]."' and id != ".$this->id.") OR (type = 'CNAME' AND name = '".$this->dataRecord["name"]."' AND zone = '".$this->dataRecord["zone"]."' and id != ".$this->id.")");
100+
$tmp = $app->db->queryOneRecord("SELECT count(id) as number FROM dns_rr WHERE (type = 'A' AND name = '".$app->db->quote($this->dataRecord["name"])."' AND zone = '".$app->db->quote($this->dataRecord["zone"])."' and data = '".$app->db->quote($this->dataRecord["data"])."' and id != ".$this->id.") OR (type = 'CNAME' AND name = '".$app->db->quote($this->dataRecord["name"])."' AND zone = '".$app->db->quote($this->dataRecord["zone"])."' and id != ".$this->id.")");
101101
if($tmp['number'] > 0) $app->tform->errorMessage .= $app->tform->lng("data_error_duplicate")."<br>";
102102
unset($tmp);
103103

‎interface/web/dns/dns_aaaa_edit.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ function onSubmit() {
8484
// Check the client limits, if user is not the admin
8585
if($_SESSION["s"]["user"]["typ"] != 'admin') { // if user is not admin
8686
// Get the limits of the client
87-
$client_group_id = $_SESSION["s"]["user"]["default_group"];
87+
$client_group_id = intval($_SESSION["s"]["user"]["default_group"]);
8888
$client = $app->db->queryOneRecord("SELECT limit_dns_record FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
8989

9090
// Check if the user may add another mailbox.
@@ -113,7 +113,7 @@ function onAfterInsert() {
113113

114114
//* Set the sys_groupid of the rr record to be the same then the sys_groupid of the soa record
115115
$soa = $app->db->queryOneRecord("SELECT sys_groupid,serial FROM dns_soa WHERE id = '".$app->functions->intval($this->dataRecord["zone"])."' AND ".$app->tform->getAuthSQL('r'));
116-
$app->db->datalogUpdate('dns_rr', "sys_groupid = ".$soa['sys_groupid'], 'id', $this->id);
116+
$app->db->datalogUpdate('dns_rr', "sys_groupid = ".intval($soa['sys_groupid']), 'id', $this->id);
117117

118118
//* Update the serial number of the SOA record
119119
$soa_id = $app->functions->intval($_POST["zone"]);

‎interface/web/dns/dns_alias_edit.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ function onShowNew() {
5757
if($_SESSION["s"]["user"]["typ"] == 'user') {
5858

5959
// Get the limits of the client
60-
$client_group_id = $_SESSION["s"]["user"]["default_group"];
60+
$client_group_id = intval($_SESSION["s"]["user"]["default_group"]);
6161
$client = $app->db->queryOneRecord("SELECT limit_dns_record FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
6262

6363
// Check if the user may add another mailbox.
@@ -84,7 +84,7 @@ function onSubmit() {
8484
// Check the client limits, if user is not the admin
8585
if($_SESSION["s"]["user"]["typ"] != 'admin') { // if user is not admin
8686
// Get the limits of the client
87-
$client_group_id = $_SESSION["s"]["user"]["default_group"];
87+
$client_group_id = intval($_SESSION["s"]["user"]["default_group"]);
8888
$client = $app->db->queryOneRecord("SELECT limit_dns_record FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
8989

9090
// Check if the user may add another mailbox.

‎interface/web/dns/dns_cname_edit.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ function onShowNew() {
5757
if($_SESSION["s"]["user"]["typ"] == 'user') {
5858

5959
// Get the limits of the client
60-
$client_group_id = $_SESSION["s"]["user"]["default_group"];
60+
$client_group_id = intval($_SESSION["s"]["user"]["default_group"]);
6161
$client = $app->db->queryOneRecord("SELECT limit_dns_record FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
6262

6363
// Check if the user may add another mailbox.
@@ -84,7 +84,7 @@ function onSubmit() {
8484
// Check the client limits, if user is not the admin
8585
if($_SESSION["s"]["user"]["typ"] != 'admin') { // if user is not admin
8686
// Get the limits of the client
87-
$client_group_id = $_SESSION["s"]["user"]["default_group"];
87+
$client_group_id = intval($_SESSION["s"]["user"]["default_group"]);
8888
$client = $app->db->queryOneRecord("SELECT limit_dns_record FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
8989

9090
// Check if the user may add another mailbox.
@@ -97,7 +97,7 @@ function onSubmit() {
9797
} // end if user is not admin
9898

9999
//* Check for duplicates where IP and hostname are the same
100-
$tmp = $app->db->queryOneRecord("SELECT count(id) as number FROM dns_rr WHERE (type = 'A' AND name = '".$this->dataRecord["name"]."' AND zone = '".$this->dataRecord["zone"]."' and id != ".$this->id.") OR (type = 'CNAME' AND name = '".$this->dataRecord["name"]."' AND zone = '".$this->dataRecord["zone"]."' and id != ".$this->id.")");
100+
$tmp = $app->db->queryOneRecord("SELECT count(id) as number FROM dns_rr WHERE (type = 'A' AND name = '".$app->db->quote($this->dataRecord["name"])."' AND zone = '".$app->db->quote($this->dataRecord["zone"])."' and id != ".$this->id.") OR (type = 'CNAME' AND name = '".$app->db->quote($this->dataRecord["name"])."' AND zone = '".$app->db->quote($this->dataRecord["zone"])."' and id != ".$this->id.")");
101101
if($tmp['number'] > 0) $app->tform->errorMessage .= $app->tform->lng("data_error_duplicate")."<br>";
102102
unset($tmp);
103103

‎interface/web/dns/dns_hinfo_edit.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ function onShowNew() {
5757
if($_SESSION["s"]["user"]["typ"] == 'user') {
5858

5959
// Get the limits of the client
60-
$client_group_id = $_SESSION["s"]["user"]["default_group"];
60+
$client_group_id = intval($_SESSION["s"]["user"]["default_group"]);
6161
$client = $app->db->queryOneRecord("SELECT limit_dns_record FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
6262

6363
// Check if the user may add another mailbox.
@@ -84,7 +84,7 @@ function onSubmit() {
8484
// Check the client limits, if user is not the admin
8585
if($_SESSION["s"]["user"]["typ"] != 'admin') { // if user is not admin
8686
// Get the limits of the client
87-
$client_group_id = $_SESSION["s"]["user"]["default_group"];
87+
$client_group_id = intval($_SESSION["s"]["user"]["default_group"]);
8888
$client = $app->db->queryOneRecord("SELECT limit_dns_record FROM sys_group, client WHERE sys_group.client_id = client.client_id and sys_group.groupid = $client_group_id");
8989

9090
// Check if the user may add another mailbox.

0 commit comments

Comments
 (0)