lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix sql injection

Browse Source
This commit is contained in:
Laurent Destailleur 2019-09-06 15:20:04 +02:00
parent cad9a59d2a
commit 348ab4765c
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/categories/viewcat.php
View File

@ -40,7 +40,7 @@ $type = GETPOST('type', 'az09');
$action=GETPOST('action', 'aZ09'); $action=GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha'); $confirm = GETPOST('confirm', 'alpha');
$removeelem = GETPOST('removeelem', 'int'); $removeelem = GETPOST('removeelem', 'int');
$elemid = GETPOST('elemid', 'alpha'); $elemid = GETPOST('elemid', 'int');
if ($id == "" && $label == "") if ($id == "" && $label == "")
{ {

2
htdocs/product/class/product.class.php
View File

@ -2052,7 +2052,7 @@ class Product extends CommonObject
$sql.= " fk_price_expression, price_autogen"; $sql.= " fk_price_expression, price_autogen";
$sql.= " FROM ".MAIN_DB_PREFIX."product"; $sql.= " FROM ".MAIN_DB_PREFIX."product";
if ($id) { if ($id) {
$sql.= " WHERE rowid = ".$this->db->escape($id); $sql.= " WHERE rowid = ".(int) $id;
} else { } else {
$sql.= " WHERE entity IN (".getEntity($this->element).")"; $sql.= " WHERE entity IN (".getEntity($this->element).")";
if ($ref) { if ($ref) {