lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Sec: Corrige injection SQL

Browse Source
This commit is contained in:
Laurent Destailleur 2007-09-11 17:30:36 +00:00
parent 8c5eacc3c7
commit da756f940d
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
htdocs/user.class.php
View File

@ -121,6 +121,9 @@ class User
{ {
global $conf; global $conf;
// Nettoyage parametres
$login=trim($login);
// Recupere utilisateur // Recupere utilisateur
$sql = "SELECT u.rowid, u.name, u.firstname, u.email, u.office_phone, u.office_fax, u.user_mobile,"; $sql = "SELECT u.rowid, u.name, u.firstname, u.email, u.office_phone, u.office_fax, u.user_mobile,";
$sql.= " u.admin, u.login, u.webcal_login, u.note,"; $sql.= " u.admin, u.login, u.webcal_login, u.note,";
@ -135,11 +138,11 @@ class User
if ($conf->ldap->enabled && $conf->global->LDAP_SYNCHRO_ACTIVE == 'ldap2dolibarr' && $this->search_sid != '') if ($conf->ldap->enabled && $conf->global->LDAP_SYNCHRO_ACTIVE == 'ldap2dolibarr' && $this->search_sid != '')
{ {
// permet une recherche du user par son SID ActiveDirectory ou Samba // permet une recherche du user par son SID ActiveDirectory ou Samba
$sql .= " WHERE (u.ldap_sid = '".$this->search_sid."' || u.login = '".$login."') LIMIT 1"; $sql .= " WHERE (u.ldap_sid = '".$this->search_sid."' || u.login = '".addslashes($login)."') LIMIT 1";
} }
else if ($login) else if ($login)
{ {
$sql .= " WHERE u.login = '".$login."'"; $sql .= " WHERE u.login = '".addslashes($login)."'";
} }
else else
{ {