From 923203802cef176e7c8a87ad4030499a2045dd47 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Wed, 12 Aug 2015 23:33:09 +0200 Subject: [PATCH] fix dangerous sql injection #3327 --- htdocs/user/class/user.class.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/user/class/user.class.php b/htdocs/user/class/user.class.php index 81beed0a69c..d20b4953a61 100644 --- a/htdocs/user/class/user.class.php +++ b/htdocs/user/class/user.class.php @@ -193,7 +193,7 @@ class User extends CommonObject if ($sid) // permet une recherche du user par son SID ActiveDirectory ou Samba { - $sql.= " AND (u.ldap_sid = '".$sid."' OR u.login = '".$this->db->escape($login)."') LIMIT 1"; + $sql.= " AND (u.ldap_sid = '".$this->db->escape($sid)."' OR u.login = '".$this->db->escape($login)."') LIMIT 1"; } else if ($login) { @@ -856,7 +856,7 @@ class User extends CommonObject else { $sql = "INSERT INTO ".MAIN_DB_PREFIX."user (datec,login,ldap_sid,entity)"; - $sql.= " VALUES('".$this->db->idate($this->datec)."','".$this->db->escape($this->login)."','".$this->ldap_sid."',".$this->db->escape($this->entity).")"; + $sql.= " VALUES('".$this->db->idate($this->datec)."','".$this->db->escape($this->login)."','".$this->db->escape($this->ldap_sid)."',".$this->db->escape($this->entity).")"; $result=$this->db->query($sql); dol_syslog(get_class($this)."::create", LOG_DEBUG);