maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

Fixing SQL-incjection found by tomreyn and general ticket-search, fixes #674

Browse Source 
Signed-off-by: Florian Aders (EleRas) <eleras@froxlor.org>
This commit is contained in:
Florian Aders (EleRas)
2011-03-19 12:22:34 +01:00
parent 6258b53a04
commit 0f4695a43f
3 changed files with 24 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
admin_tickets.php
View File

@@ -597,8 +597,7 @@ elseif($page == 'archive'
{ {
$categories[$x] = isset($_POST['category' . $x]) ? $_POST['category' . $x] : ''; $categories[$x] = isset($_POST['category' . $x]) ? $_POST['category' . $x] : '';
} }
$query = ticket::getArchiveSearchStatement($db, $subject, $priority, $fromdate, $todate, $message, $customer, $userinfo['adminid'], $categories);
$query = ticket::getArchiveSearchStatement($subject, $priority, $fromdate, $todate, $message, $customer, $userinfo['adminid'], $categories);
$fields = array( $fields = array(
'lastchange' => $lng['ticket']['lastchange'], 'lastchange' => $lng['ticket']['lastchange'],
'ticket_answers' => $lng['ticket']['ticket_answers'], 'ticket_answers' => $lng['ticket']['ticket_answers'],

34
lib/classes/ticket/class.ticket.php
View File

@@ -508,18 +508,18 @@ class ticket
* Returns a sql-statement to search the archive * Returns a sql-statement to search the archive
*/ */
static public function getArchiveSearchStatement($subject = NULL, $priority = NULL, $fromdate = NULL, $todate = NULL, $message = NULL, $customer = - 1, $admin = 1, $categories = NULL) static public function getArchiveSearchStatement($db, $subject = NULL, $priority = NULL, $fromdate = NULL, $todate = NULL, $message = NULL, $customer = - 1, $admin = 1, $categories = NULL)
{ {
$query = 'SELECT `main`.*, $query = 'SELECT `main`.*,
(SELECT COUNT(`sub`.`id`) FROM `' . TABLE_PANEL_TICKETS . '` `sub` (SELECT COUNT(`sub`.`id`) FROM `' . TABLE_PANEL_TICKETS . '` `sub`
WHERE `sub`.`answerto` = `main`.`id`) as `ticket_answers` WHERE `sub`.`answerto` = `main`.`id`) as `ticket_answers`
FROM `' . TABLE_PANEL_TICKETS . '` `main` FROM `' . TABLE_PANEL_TICKETS . '` `main`
WHERE `main`.`archived` = "1" AND `main`.`answerto` = "0" AND `main`.`adminid` = "' . (int)$admin . '"'; WHERE `main`.`archived` = "1" AND `main`.`adminid` = "' . (int)$admin . '" ';
if($subject != NULL if($subject != NULL
&& $subject != '') && $subject != '')
{ {
$query.= 'AND `main`.`subject` LIKE "%' . $subject . '%" '; $query.= 'AND `main`.`subject` LIKE "' . $db->escape("%$subject%") . '" ';
} }
if($priority != NULL if($priority != NULL
@@ -560,8 +560,7 @@ class ticket
if(isset($priority[2]) if(isset($priority[2])
&& $priority[2] != '') && $priority[2] != '')
{ {
$query.= 'AND (`main`.`priority` = "2" $query.= 'AND (`main`.`priority` = "2" OR `main`.`priority` = "3") ';
OR `main`.`priority` = "3") ';
} }
else else
{ {
@@ -580,43 +579,52 @@ class ticket
if($fromdate != NULL if($fromdate != NULL
&& $fromdate > 0) && $fromdate > 0)
{ {
$query.= 'AND `main`.`lastchange` > "' . $fromdate . '" '; $query.= 'AND `main`.`lastchange` > "' . $db->escape(strtotime($fromdate)) . '" ';
} }
if($todate != NULL if($todate != NULL
&& $todate > 0) && $todate > 0)
{ {
$query.= 'AND `main`.`lastchange` < "' . $todate . '" '; $query.= 'AND `main`.`lastchange` < "' . $db->escape(strtotime($todate)) . '" ';
} }
if($message != NULL if($message != NULL
&& $message != '') && $message != '')
{ {
$query.= 'AND `main`.`message` LIKE "%' . $message . '%" '; $query.= 'AND `main`.`message` LIKE "' . $db->escape("%$message%") . '" ';
} }
if($customer != - 1) if($customer != - 1)
{ {
$query.= 'AND `main`.`customerid` = "' . $customer . '" '; $query.= 'AND `main`.`customerid` = "' . (int)$customer . '" ';
} }
if($categories != NULL) if($categories != NULL)
{ {
if($categories[0] != '') $cats = array();
foreach($categories as $index => $catid)
{
if ($catid != "")
{
$cats[] = $catid;
}
}
if (count($cats) > 0)
{ {
$query.= 'AND ('; $query.= 'AND (';
} }
foreach($categories as $catid) foreach($cats as $catid)
{ {
if(isset($catid) if(isset($catid)
&& $catid > 0) && $catid > 0)
{ {
$query.= '`main`.`category` = "' . $catid . '" OR '; $query.= '`main`.`category` = "' . (int)$catid . '" OR ';
} }
} }
if($categories[0] != '') if (count($cats) > 0)
{ {
$query = substr($query, 0, strlen($query) - 3); $query = substr($query, 0, strlen($query) - 3);
$query.= ') '; $query.= ') ';

2
templates/Froxlor/admin/ticket/archivesearch.tpl
View File

@@ -5,7 +5,7 @@ $header
<input type="hidden" name="send" value="send" /> <input type="hidden" name="send" value="send" />
<table cellpadding="5" cellspacing="0" border="0" align="center" class="maintable"> <table cellpadding="5" cellspacing="0" border="0" align="center" class="maintable">
<tr> <tr>
<td class="maintitle_search_left" colspan="5"><b><img src="images/title.gif" alt="" />&nbsp;{$lng['ticket']['archivesearch']}</b></td> <td class="maintitle_search_left" colspan="5"><b><img src="images/Froxlor/icons/ticket_archive.png" alt="" />&nbsp;{$lng['ticket']['archivesearch']}</b></td>
<td class="maintitle_search_right">&nbsp;</td> <td class="maintitle_search_right">&nbsp;</td>
</tr> </tr>
<if 0 < $tickets_count > <if 0 < $tickets_count >