Skip to content

Commit 5b57c1f

Browse files
d--jd--j
committed
escape reserved keyword groups in SQL queries
fixes #6764
1 parent 8188fb6 commit 5b57c1f

File tree

4 files changed

+43
-43
lines changed

4 files changed

+43
-43
lines changed

‎interface/lib/classes/auth.inc.php‎

Lines changed: 27 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ public function is_admin() {
4444
return false;
4545
}
4646
}
47-
47+
4848
public function is_superadmin() {
4949
if($_SESSION['s']['user']['typ'] == 'admin' && $_SESSION['s']['user']['userid'] == 1) {
5050
return true;
@@ -71,11 +71,11 @@ public function has_clients($userid) {
7171
return false;
7272
}
7373
}
74-
74+
7575
// Function to check if a client belongs to a reseller
7676
public function is_client_of_reseller($userid = 0) {
7777
global $app, $conf;
78-
78+
7979
if($userid == 0) $userid = $_SESSION['s']['user']['userid'];
8080

8181
$client = $app->db->queryOneRecord("SELECT client.sys_userid, client.sys_groupid FROM sys_user, client WHERE sys_user.userid = ? AND sys_user.client_id = client.client_id", $userid);
@@ -98,7 +98,7 @@ public function add_group_to_user($userid, $groupid) {
9898
$groups = explode(',', $user['groups']);
9999
if(!in_array($groupid, $groups)) $groups[] = $groupid;
100100
$groups_string = implode(',', $groups);
101-
$sql = "UPDATE sys_user SET groups = ? WHERE userid = ?";
101+
$sql = "UPDATE sys_user SET `groups` = ? WHERE userid = ?";
102102
$app->db->query($sql, $groups_string, $userid);
103103
return true;
104104
} else {
@@ -110,10 +110,10 @@ public function add_group_to_user($userid, $groupid) {
110110
public function get_client_limit($userid, $limitname)
111111
{
112112
global $app;
113-
113+
114114
$userid = $app->functions->intval($userid);
115115
if(!preg_match('/^[a-zA-Z0-9\-\_]{1,64}$/',$limitname)) $app->error('Invalid limit name '.$limitname);
116-
116+
117117
// simple query cache
118118
if($this->client_limits===null)
119119
$this->client_limits = $app->db->queryOneRecord("SELECT client.* FROM sys_user, client WHERE sys_user.userid = ? AND sys_user.client_id = client.client_id", $userid);
@@ -140,7 +140,7 @@ public function remove_group_from_user($userid, $groupid) {
140140
$key = array_search($groupid, $groups);
141141
unset($groups[$key]);
142142
$groups_string = implode(',', $groups);
143-
$sql = "UPDATE sys_user SET groups = ? WHERE userid = ?";
143+
$sql = "UPDATE sys_user SET `groups` = ? WHERE userid = ?";
144144
$app->db->query($sql, $groups_string, $userid);
145145
return true;
146146
} else {
@@ -188,11 +188,11 @@ public function check_module_permissions($module) {
188188
exit;
189189
}
190190
}
191-
191+
192192
public function check_security_permissions($permission) {
193-
193+
194194
global $app;
195-
195+
196196
$app->uses('getconf');
197197
$security_config = $app->getconf->get_security_config('permissions');
198198

@@ -202,7 +202,7 @@ public function check_security_permissions($permission) {
202202
if($security_check !== true) {
203203
$app->error($app->lng('security_check1_txt').' '.$permission.' '.$app->lng('security_check2_txt'));
204204
}
205-
205+
206206
}
207207

208208
/**
@@ -239,12 +239,12 @@ public function get_random_password($minLength = 8, $special = false) {
239239
if($minLength < 8) $minLength = 8;
240240
$maxLength = $minLength + 5;
241241
$length = random_int($minLength, $maxLength);
242-
242+
243243
$alphachars = "abcdefghijklmnopqrstuvwxyz";
244244
$upperchars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
245245
$numchars = "1234567890";
246246
$specialchars = "!@#_";
247-
247+
248248
$num_special = 0;
249249
if($special == true) {
250250
$num_special = intval(random_int(0, round($length / 4))) + 1;
@@ -254,31 +254,31 @@ public function get_random_password($minLength = 8, $special = false) {
254254
$upperlen = intval($alphalen / 2);
255255
$alphalen = $alphalen - $upperlen;
256256
$password = '';
257-
257+
258258
for($i = 0; $i < $alphalen; $i++) {
259259
$password .= substr($alphachars, random_int(0, strlen($alphachars) - 1), 1);
260260
}
261-
261+
262262
for($i = 0; $i < $upperlen; $i++) {
263263
$password .= substr($upperchars, random_int(0, strlen($upperchars) - 1), 1);
264264
}
265-
265+
266266
for($i = 0; $i < $num_special; $i++) {
267267
$password .= substr($specialchars, random_int(0, strlen($specialchars) - 1), 1);
268268
}
269-
269+
270270
for($i = 0; $i < $numericlen; $i++) {
271271
$password .= substr($numchars, random_int(0, strlen($numchars) - 1), 1);
272272
}
273-
273+
274274
return str_shuffle($password);
275275
}
276276

277277
public function crypt_password($cleartext_password, $charset = 'UTF-8') {
278278
if($charset != 'UTF-8') {
279279
$cleartext_password = mb_convert_encoding($cleartext_password, $charset, 'UTF-8');
280280
}
281-
281+
282282
if(defined('CRYPT_SHA512') && CRYPT_SHA512 == 1) {
283283
$salt = '$6$rounds=5000$';
284284
$salt_length = 16;
@@ -289,7 +289,7 @@ public function crypt_password($cleartext_password, $charset = 'UTF-8') {
289289
$salt = '$1$';
290290
$salt_length = 12;
291291
}
292-
292+
293293
if(function_exists('openssl_random_pseudo_bytes')) {
294294
$salt .= substr(bin2hex(openssl_random_pseudo_bytes($salt_length)), 0, $salt_length);
295295
} else {
@@ -301,7 +301,7 @@ public function crypt_password($cleartext_password, $charset = 'UTF-8') {
301301
$salt .= "$";
302302
return crypt($cleartext_password, $salt);
303303
}
304-
304+
305305
public function csrf_token_get($form_name) {
306306
/* CSRF PROTECTION */
307307
// generate csrf protection id and key
@@ -311,24 +311,24 @@ public function csrf_token_get($form_name) {
311311
if(!isset($_SESSION['_csrf_timeout'])) $_SESSION['_csrf_timeout'] = array();
312312
$_SESSION['_csrf'][$_csrf_id] = $_csrf_key;
313313
$_SESSION['_csrf_timeout'][$_csrf_id] = time() + 3600; // timeout hash in 1 hour
314-
314+
315315
return array('csrf_id' => $_csrf_id,'csrf_key' => $_csrf_key);
316316
}
317-
317+
318318
public function csrf_token_check($method = 'POST') {
319319
global $app;
320-
320+
321321
if($method == 'POST') {
322322
$input_vars = $_POST;
323323
} elseif ($method == 'GET') {
324324
$input_vars = $_GET;
325325
} else {
326326
$app->error('Unknown CSRF verification method.');
327327
}
328-
328+
329329
//print_r($input_vars);
330330
//die(print_r($_SESSION['_csrf']));
331-
331+
332332
if(isset($input_vars) && is_array($input_vars)) {
333333
$_csrf_valid = false;
334334
if(isset($input_vars['_csrf_id']) && isset($input_vars['_csrf_key'])) {
@@ -346,7 +346,7 @@ public function csrf_token_check($method = 'POST') {
346346
$_SESSION['_csrf_timeout'][$_csrf_id] = null;
347347
unset($_SESSION['_csrf'][$_csrf_id]);
348348
unset($_SESSION['_csrf_timeout'][$_csrf_id]);
349-
349+
350350
if(isset($_SESSION['_csrf_timeout']) && is_array($_SESSION['_csrf_timeout'])) {
351351
$to_unset = array();
352352
foreach($_SESSION['_csrf_timeout'] as $_csrf_id => $timeout) {

‎interface/lib/classes/functions.inc.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -672,7 +672,7 @@ public function func_client_cancel($client_id,$cancel) {
672672
$result = false;
673673
}
674674
return $result;
675-
}
675+
}
676676

677677
/**
678678
* Lookup a client's group + all groups he is reselling.
@@ -683,8 +683,8 @@ function clientid_to_groups_list($client_id) {
683683
global $app;
684684

685685
if ($client_id != null) {
686-
// Get the clients groupid, and incase it's a reseller the groupid's of it's clients.
687-
$group = $app->db->queryOneRecord("SELECT GROUP_CONCAT(groupid) AS groups FROM `sys_group` WHERE client_id IN (SELECT client_id FROM `client` WHERE client_id=? OR parent_client_id=?)", $client_id, $client_id);
686+
// Get the clients groupid, and in case it's a reseller the groupid's of its clients.
687+
$group = $app->db->queryOneRecord("SELECT GROUP_CONCAT(groupid) AS `groups` FROM `sys_group` WHERE client_id IN (SELECT client_id FROM `client` WHERE client_id=? OR parent_client_id=?)", $client_id, $client_id);
688688
return $group['groups'];
689689
}
690690
return null;

‎interface/lib/classes/tform.inc.php‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ function getNextTab() {
115115
// Show the same tab again in case of an error
116116
$active_tab = $_SESSION["s"]["form"]["tab"];
117117
}
118-
118+
119119
if(!preg_match('/^[a-zA-Z0-9_]{0,50}$/',$active_tab)) {
120120
die('Invalid next tab name.');
121121
}
@@ -132,7 +132,7 @@ function getCurrentTab() {
132132

133133
function isReadonlyTab($tab, $primary_id) {
134134
global $app, $conf;
135-
135+
136136
if(isset($this->formDef['tabs'][$tab]['readonly']) && $this->formDef['tabs'][$tab]['readonly'] == true) {
137137

138138
// Add backticks for incomplete table names.
@@ -149,7 +149,7 @@ function isReadonlyTab($tab, $primary_id) {
149149
if($record['sys_userid'] != $_SESSION["s"]["user"]["userid"]) {
150150
return true;
151151
} else {
152-
return false;
152+
return false;
153153
}
154154
} else {
155155
return false;
@@ -204,7 +204,7 @@ function checkResellerLimit($limit_name, $sql_where = '') {
204204
if($client['parent_client_id'] != 0) {
205205

206206
//* first we need to know the groups of this reseller
207-
$tmp = $app->db->queryOneRecord("SELECT userid, groups FROM sys_user WHERE client_id = ?", $client['parent_client_id']);
207+
$tmp = $app->db->queryOneRecord("SELECT userid, `groups` FROM sys_user WHERE client_id = ?", $client['parent_client_id']);
208208
$reseller_groups = $tmp["groups"];
209209
$reseller_userid = $tmp["userid"];
210210

@@ -247,7 +247,7 @@ function getDiffRecord($record_old, $record_new) {
247247
return $diffrec;
248248

249249
}
250-
250+
251251
/**
252252
* Generate HTML for DATE fields.
253253
*
@@ -260,10 +260,10 @@ function _getDateHTML($form_element, $default_value)
260260
{
261261
$_date = ($default_value && $default_value != '0000-00-00' ? strtotime($default_value) : false);
262262
$_showdate = ($_date === false) ? false : true;
263-
263+
264264
$tmp_dt = strtr($this->dateformat,array('d' => 'dd', 'm' => 'mm', 'Y' => 'yyyy', 'y' => 'yy'));
265-
266-
return '<input type="text" class="form-control" name="' . $form_element . '" value="' . ($_showdate ? date($this->dateformat, $_date) : '') . '" data-input-element="date" data-date-format="' . $tmp_dt . '" />';
265+
266+
return '<input type="text" class="form-control" name="' . $form_element . '" value="' . ($_showdate ? date($this->dateformat, $_date) : '') . '" data-input-element="date" data-date-format="' . $tmp_dt . '" />';
267267
}
268268

269269

@@ -285,12 +285,12 @@ function _getDateTimeHTML($form_element, $default_value, $display_seconds=false)
285285
if ($display_seconds === true) {
286286
$dselect[] = 'second';
287287
}
288-
288+
289289
$tmp_dt = strtr($this->datetimeformat,array('d' => 'dd', 'm' => 'mm', 'Y' => 'yyyy', 'y' => 'yy', 'H' => 'hh', 'h' => 'HH', 'i' => 'ii')) . ($display_seconds ? ':ss' : '');
290290

291291
$out = '';
292-
293-
return '<input type="text" class="form-control" name="' . $form_element . '" value="' . ($_showdate ? date($this->datetimeformat . ($display_seconds ? ':s' : ''), $_datetime) : '') . '" data-input-element="datetime" data-date-format="' . $tmp_dt . '" />';
292+
293+
return '<input type="text" class="form-control" name="' . $form_element . '" value="' . ($_showdate ? date($this->datetimeformat . ($display_seconds ? ':s' : ''), $_datetime) : '') . '" data-input-element="datetime" data-date-format="' . $tmp_dt . '" />';
294294
/*
295295
foreach ($dselect as $dt_element)
296296
{
@@ -352,7 +352,7 @@ function _getDateTimeHTML($form_element, $default_value, $display_seconds=false)
352352
$selected_value = (int)floor(date('s', $_datetime));
353353
break;
354354
}
355-
355+
356356
$out .= "<select name=\"".$form_element."[$dt_element]\" id=\"".$form_element."_$dt_element\" class=\"selectInput\" style=\"width: auto; float: none;\">";
357357
if (!$_showdate) {
358358
$out .= "<option value=\"-\" selected=\"selected\">--</option>" . PHP_EOL;

‎interface/lib/classes/tform_base.inc.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -379,7 +379,7 @@ function applyValueLimit($formtype, $limit, $values, $current_value = '') {
379379
if($client['parent_client_id'] != 0) {
380380

381381
//* first we need to know the groups of this reseller
382-
$tmp = $app->db->queryOneRecord("SELECT userid, groups FROM sys_user WHERE client_id = ?", $client['parent_client_id']);
382+
$tmp = $app->db->queryOneRecord("SELECT userid, `groups` FROM sys_user WHERE client_id = ?", $client['parent_client_id']);
383383
$reseller_groups = $tmp["groups"];
384384
$reseller_userid = $tmp["userid"];
385385

0 commit comments

Comments
 (0)