lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

escape missing in sql request

Browse Source
This commit is contained in:
Faustin 2023-01-22 13:54:39 +01:00
parent 9806941217
commit 4208cb3bc6
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
htdocs/admin/oauth.php
View File

@ -123,9 +123,10 @@ if ($action == 'update') {
$oldlabel = preg_replace('/^.*-/', '', $oldname);
$newlabel = preg_replace('/^.*-/', '', $newconstvalue);
$sql = "UPDATE ".MAIN_DB_PREFIX."oauth_token";
$sql.= " SET service = '".$oldprovider."-".$newlabel."'";
$sql.= " WHERE service = '".$oldprovider."-".$oldlabel."'";
$sql.= " SET service = '".$db->escape($oldprovider."-".$newlabel)."'";
$sql.= " WHERE service = '".$db->escape($oldprovider."-".$oldlabel)."'";
$resql = $db->query($sql);