tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Use bound parameters for every query that takes user data.

Browse Source 
The queue image query took $id without quotes or a check, which allowed
SQL injection.
This commit is contained in:
tim
2026-09-25 21:29:09 +02:00
parent cda0602c95
commit c85f54116c
7 changed files with 70 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files
get_data.lib.php
+14 -19
View File
@@ -105,28 +105,25 @@ function get_count() {
$search = get_search_args();
$queue = get_queue();
$table = which_table();
$params = array();
// if search= is defined, search....
if ($search) {
$count_query = "SELECT COUNT(*) FROM $table WHERE".
" ( title LIKE '%".$search."%'".
" OR author LIKE '%".$search."%'".
" OR date LIKE '%".$search."%'".
" OR story LIKE '%".$search."%'".
" )";
" (title LIKE ? OR author LIKE ? OR date LIKE ? OR story LIKE ?)";
$params = array_fill(0, 4, "%$search%");
// Otherwise, fall back to default view
} else {
$count_query = "SELECT COUNT(*) FROM ".$table." WHERE 1";
}
if (!$is_admin)
$count_query .= " AND hidden IS NOT TRUE";
$count_query .= " ;";
//echo $count_query." <br />";
$row_count = NULL;
echo $db->info;
if ($count_query) {
if ($result = $db->query($count_query)) {
if ($result = $db->execute_query($count_query, $params)) {
$row_count = $result->fetch_row();
$result->close();
} else {
@@ -149,35 +146,34 @@ function get_query($id = NULL) {
$queue = get_queue();
$table = which_table();
$results = array();
$params = array();
$limit = " LIMIT ".(int)$start." , ".(int)$show;
// If id= is defined, show the corresponding application only
if (is_numeric($id)) {
if (!$is_admin)
$query = "SELECT * FROM $table WHERE 1 AND hidden IS NOT TRUE AND id = ".$id." LIMIT 0, 1";
$query = "SELECT * FROM $table WHERE 1 AND hidden IS NOT TRUE AND id = ".(int)$id." LIMIT 0, 1";
else
$query = "SELECT * FROM $table WHERE 1 AND id = ".$id." LIMIT 0, 1";
$query = "SELECT * FROM $table WHERE 1 AND id = ".(int)$id." LIMIT 0, 1";
// if search= is defined, search....
} else if ($search) {
$query = "SELECT * FROM $table WHERE".
" ( title LIKE '%".$search."%'".
" OR author LIKE '%".$search."%'".
" OR date LIKE '%".$search."%'".
" OR story LIKE '%".$search."%'".
" )";
" (title LIKE ? OR author LIKE ? OR date LIKE ? OR story LIKE ?)";
$params = array_fill(0, 4, "%$search%");
if (!$is_admin)
$query .= " AND hidden IS NOT TRUE";
$query .= " ORDER BY ".$sort." " .$order." LIMIT " .$start." , ".$show." ;";
$query .= " ORDER BY ".$sort." ".$order.$limit;
// Otherwise, fall back to default view
} else {
$query = "SELECT * FROM ".$table." WHERE 1";
if (!$is_admin)
$query .= " AND hidden IS NOT TRUE";
$query .= " ORDER BY ".$sort." " .$order." LIMIT " .$start." , ".$show." ;";
$query .= " ORDER BY ".$sort." ".$order.$limit;
}
//echo $query;
if ($result = $db->query($query)) {
if ($result = $db->execute_query($query, $params)) {
while ($row = $result->fetch_assoc()) {
$row['queue_url'] = $queue ? 1 : 0;
$results[] = $row;
@@ -256,8 +252,7 @@ function get_id() {
function get_search_args() {
global $db;
if (isset($_GET['search']) && is_string($_GET['search'])) {
$search = $db->real_escape_string($_GET['search']);
return $search;
return $_GET['search'];
}
}