lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Security fix emailing read and unsubscribe

Browse Source 
unsubscribe can lead to email disclosure
This commit is contained in:
Cedric GROSS 2013-01-04 13:01:48 +01:00
parent 6aebf470f6
commit b4ad2887a0
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
htdocs/public/emailing/mailing-read.php
View File

@ -41,6 +41,9 @@ if (empty($conf->global->MAILING_EMAIL_UNSUBSCRIBE)) accessforbidden('Option not
if ($id!='')
{
//escape id avoiding SQL Injection
$id=$db->escape($id);
$statut='2';
$sql = "UPDATE ".MAIN_DB_PREFIX."mailing_cibles SET statut=".$statut." WHERE tag='".$id."'";
dol_syslog("public/emailing/mailing-read.php : Mail read : ".$sql, LOG_DEBUG);

5
htdocs/public/emailing/mailing-unsubscribe.php
View File

@ -29,7 +29,7 @@ define("NOLOGIN",1); // This means this output page does not require to be logg
define("NOCSRFCHECK",1); // We accept to go on this page from external web site.
require("../../main.inc.php");
require_once(DOL_DOCUMENT_ROOT."/lib/company.lib.php");
require_once(DOL_DOCUMENT_ROOT."/core/lib/company.lib.php");
global $user, $conf, $langs;
@ -48,6 +48,9 @@ if (empty($conf->global->MAILING_EMAIL_UNSUBSCRIBE)) accessforbidden('Option not
if (($id!='') && ($unsuscrib=='1'))
{
//escape id avoiding SQL Injection
$id=$db->escape($id);
//Udate status of mail in Destinaries maling list
$statut='3';
$sql = "UPDATE ".MAIN_DB_PREFIX."mailing_cibles SET statut=".$statut." WHERE tag='".$id."'";