maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

allow api _plainsql special parameter only for internal calls, not needed anywhere else

Browse Source 
Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
This commit is contained in:
Michael Kaufmann
2022-12-14 18:42:06 +01:00
parent e5b6492804
commit c19b7d02ab
3 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
lib/Froxlor/Api/ApiCommand.php
View File

@@ -276,7 +276,7 @@ abstract class ApiCommand extends ApiParameter
];
$first = true;
foreach ($search as $field => $valoper) {
if ($field == '_plainsql') {
if ($field == '_plainsql' && $this->internal_call) {
if (isset($valoper['sql']) && isset($valoper['values']) && is_array($valoper['values'])) {
if (preg_match('/^([a-z0-9\-\.,=\+_`\(\)\:\'\"\!\<\>\ ]+)$/i', $valoper['sql']) == false) {
// skip