From c4eea1f0e05307cf8190f4aee1571d474a9e32ab Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Thu, 15 Mar 2018 02:12:01 +0100 Subject: [PATCH] Fix SQLi --- htdocs/core/class/translate.class.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/core/class/translate.class.php b/htdocs/core/class/translate.class.php index 7b6ef9bbde1..3b864889e48 100644 --- a/htdocs/core/class/translate.class.php +++ b/htdocs/core/class/translate.class.php @@ -895,7 +895,7 @@ class Translate $sql = "SELECT ".$fieldlabel." as label"; $sql.= " FROM ".MAIN_DB_PREFIX.$tablename; - $sql.= " WHERE ".$fieldkey." = '".($keyforselect?$keyforselect:$key)."'"; + $sql.= " WHERE ".$fieldkey." = '".$db->escape($keyforselect?$keyforselect:$key)."'"; if ($filteronentity) $sql.= " AND entity IN (" . getEntity($tablename). ')'; dol_syslog(get_class($this).'::getLabelFromKey', LOG_DEBUG); $resql = $db->query($sql); @@ -977,7 +977,7 @@ class Translate $sql = "SELECT code_iso, label, unicode"; $sql.= " FROM ".MAIN_DB_PREFIX."c_currencies"; $sql.= " WHERE active = 1"; - if (! empty($currency_code)) $sql.=" AND code_iso = '".$currency_code."'"; + if (! empty($currency_code)) $sql.=" AND code_iso = '".$db->escape($currency_code)."'"; //$sql.= " ORDER BY code_iso ASC"; // Not required, a sort is done later dol_syslog(get_class($this).'::loadCacheCurrencies', LOG_DEBUG);