maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

Fixing SQL-incjection found by tomreyn and general ticket-search, fixes #674

Browse Source 
Signed-off-by: Florian Aders (EleRas) <eleras@froxlor.org>
This commit is contained in:
Florian Aders (EleRas)
2011-03-19 12:22:34 +01:00
parent 6258b53a04
commit 0f4695a43f
3 changed files with 24 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
admin_tickets.php
View File

@@ -597,8 +597,7 @@ elseif($page == 'archive'
{
$categories[$x] = isset($_POST['category' . $x]) ? $_POST['category' . $x] : '';
}
$query = ticket::getArchiveSearchStatement($subject, $priority, $fromdate, $todate, $message, $customer, $userinfo['adminid'], $categories);
$query = ticket::getArchiveSearchStatement($db, $subject, $priority, $fromdate, $todate, $message, $customer, $userinfo['adminid'], $categories);
$fields = array(
'lastchange' => $lng['ticket']['lastchange'],
'ticket_answers' => $lng['ticket']['ticket_answers'],