lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

WIP #6504: CVE-2017-7886

Browse Source 
'defaultlang' attribute was not filtered before database request which cause an SQL injection.
This commit is contained in:
jfefe 2017-05-10 20:32:54 +02:00 committed by GitHub
parent 0c9f268f99
commit d410a320d7
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/core/class/translate.class.php
View File

@ -439,7 +439,7 @@ class Translate
if (! $found)
{
// Overwrite translation with database read
$sql="SELECT transkey, transvalue FROM ".MAIN_DB_PREFIX."overwrite_trans where lang='".$this->defaultlang."'";
$sql="SELECT transkey, transvalue FROM ".MAIN_DB_PREFIX."overwrite_trans where lang='".$db->escape($this->defaultlang)."'";
$resql=$db->query($sql);
if ($resql)