tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Use bound parameters for every query that takes user data.

Browse Source 
The queue image query took $id without quotes or a check, which allowed
SQL injection.
This commit is contained in:
tim
2026-09-25 21:29:09 +02:00
parent cda0602c95
commit c85f54116c
7 changed files with 70 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files
publish/addeditor.php
+5 -8
View File
@@ -12,14 +12,11 @@ if (!isset($_SESSION['editor'])) {
open_db('open');
$table = "editors";
$username = $db->real_escape_string($_POST['username'] ?? '');
$password = $db->real_escape_string(password_hash($_POST['password'] ?? '', PASSWORD_DEFAULT));
$email = $db->real_escape_string($_POST['email'] ?? '');
$query = "INSERT INTO $table SET".
"`username` = '".$username."', ".
"`password` = '".$password."', ".
"`email` = '".$email."'; ";
if ($result = $db->query($query)) {
$username = (string)($_POST['username'] ?? '');
$password = password_hash((string)($_POST['password'] ?? ''), PASSWORD_DEFAULT);
$email = (string)($_POST['email'] ?? '');
$query = "INSERT INTO $table SET `username` = ?, `password` = ?, `email` = ?";
if ($result = $db->execute_query($query, array($username, $password, $email))) {
$added = TRUE;
$is_admin = TRUE;
}
publish/login.php
+3 -5
View File
@@ -14,11 +14,9 @@ if (isset($_SESSION['editor'])) {
$table = "editors";
open_db('open');
$username = $db->real_escape_string($_POST['username'] ?? '');
$query = "SELECT * FROM $table WHERE ".
"username LIKE '".$username."' ".
"LIMIT 1;";
$getid = $db->query($query) or die("Query failed: ".$db->error);
$username = (string)($_POST['username'] ?? '');
$query = "SELECT * FROM $table WHERE username LIKE ? LIMIT 1";
$getid = $db->execute_query($query, array($username)) or die("Query failed: ".$db->error);
$row = $getid->fetch_assoc();
$stored_password = '';
publish/post.lib.php
+34 -34
View File
@@ -22,6 +22,7 @@ function save_data($id = NULL) {
$comments = NULL;
$editor = 'original author';
}
$id = is_numeric($id) ? (int)$id : NULL;
$queue = get_queue();
// Are we posting a story from the queue?
@@ -37,10 +38,9 @@ function save_data($id = NULL) {
if (!$date)
$date = gmdate("Y-m-d H:i:s");
// Verify image
if ($move && isset($uploaded) && $uploaded === $id) {
if ($move && isset($id) && isset($uploaded) && $uploaded === (string)$id) {
// Special case - transfer image from queue table
$query = "SELECT img, mime FROM queue WHERE id = $id;";
if ($getimg = $db->query($query)) {
if ($getimg = $db->execute_query("SELECT img, mime FROM queue WHERE id = ?", array($id))) {
$row = $getimg->fetch_assoc();
$img = $row['img'];
$mime = $row['mime'];
@@ -56,43 +56,43 @@ function save_data($id = NULL) {
}
}
if (is_numeric($id) && !$move)
$query = "UPDATE $table SET";
else
$query = "INSERT INTO $table SET";
$query .= " `title` = '".$db->real_escape_string($title)."'"
.", `author` = '".$db->real_escape_string($author)."'"
.", `email` = '".$db->real_escape_string($email)."'"
.", `editor` = '".$db->real_escape_string($editor)."'";
// Column => value; the values are bound as query parameters
$fields = array(
'title' => $title,
'author' => $author,
'email' => $email,
'editor' => $editor,
);
if ($is_admin && isset($comments)) {
$query .= ", `comments` = '".$db->real_escape_string($comments)."'";
}
if ($hidden) {
$query .= ", `hidden` = TRUE";
} else {
$query .= ", `hidden` = FALSE";
$fields['comments'] = $comments;
}
$fields['hidden'] = $hidden ? 1 : 0;
if ($remove_img && $story) {
$query .= ", `story` = '".$db->real_escape_string($story)."'";
$query .= ", `mime` = NULL";
$query .= ", `img` = NULL";
$fields['story'] = $story;
$fields['mime'] = NULL;
$fields['img'] = NULL;
} else if (isset($img)) {
$query .= ", `mime` = '".$db->real_escape_string($mime)."'";
$query .= ", `img` = '".$db->real_escape_string($img)."'";
$query .= ", `story` = ''";
$fields['mime'] = $mime;
$fields['img'] = $img;
$fields['story'] = '';
} else {
$query .= ", `story` = '".$db->real_escape_string($story)."'";
$fields['story'] = $story;
}
if (!is_numeric($id) || $move)
$query .= ", `date` = '".$db->real_escape_string($date)."'";
if (is_numeric($id) && !$move)
$query .= " WHERE `id` = '".$id."' LIMIT 1;";
else
$query .= ";";
$fields['date'] = $date;
$set = implode(', ', array_map(function ($column) { return "`$column` = ?"; }, array_keys($fields)));
$params = array_values($fields);
if (is_numeric($id) && !$move) {
$query = "UPDATE $table SET $set WHERE `id` = ? LIMIT 1";
$params[] = $id;
} else {
$query = "INSERT INTO $table SET $set";
}
//echo $query;
$result = $db->query($query) or die("Query failed: ".$db->error);
$result = $db->execute_query($query, $params) or die("Query failed: ".$db->error);
if (is_numeric($id) && $move) {
$queue_id = $id;
}
@@ -134,9 +134,9 @@ function delete_story($id, $move = FALSE) {
$queue = get_queue();
$table = which_table($move, 'delete');
$query = "DELETE FROM $table WHERE `id` = '".$id."' LIMIT 1;";
$query = "DELETE FROM $table WHERE `id` = ? LIMIT 1";
//echo $query;
$result = $db->query($query)or die("Query failed : ".$db->error);
$result = $db->execute_query($query, array((int)$id)) or die("Query failed : ".$db->error);
$message = '';
if (!$move)