Browse Source

Fixed many possible SQL injections in links edition (legacy code - needs improvements)

Yannick Warnier 15 years ago
parent
commit
4de52db3b4
1 changed files with 11 additions and 11 deletions
  1. 11 11
      main/link/linkfunctions.php

+ 11 - 11
main/link/linkfunctions.php

@@ -334,7 +334,7 @@ function editlinkcategory($type) {
 			$category_id = $row['category_id'];
 
 			if ($category_id != $_POST['selectcategory']) {
-				$sql = "SELECT MAX(display_order) FROM ".$tbl_link." WHERE category_id='".$_POST['selectcategory']."'";
+				$sql = "SELECT MAX(display_order) FROM ".$tbl_link." WHERE category_id='".intval($_POST['selectcategory'])."'";
 				$result = Database::query($sql);
 				list ($max_display_order) = Database::fetch_row($result);
 				$max_display_order ++;
@@ -347,11 +347,11 @@ function editlinkcategory($type) {
 
             // Update search enchine and its values table if enabled
             if (api_get_setting('search_enabled') == 'true') {
-                $link_id = $_POST['id'];
+                $link_id = intval($_POST['id']);
                 $course_id = api_get_course_id();
-                $link_url = $_POST['urllink'];
-                $link_title = $_POST['title'];
-                $link_description = $_POST['description'];
+                $link_url = Database::escape_string($_POST['urllink']);
+                $link_title = Database::escape_string($_POST['title']);
+                $link_description = Database::escape_string($_POST['description']);
 
                 // Actually, it consists on delete terms from db, insert new ones, create a new search engine document, and remove the old one
 	            // get search_did
@@ -443,7 +443,7 @@ function editlinkcategory($type) {
 
 		// This is used to populate the category-form with the info found in the database
 		if (!$submit_category) {
-			$sql = "SELECT * FROM ".$tbl_categories." WHERE id='".$_GET['id']."'";
+			$sql = "SELECT * FROM ".$tbl_categories." WHERE id='".intval($_GET['id'])."'";
 			$result = Database::query($sql);
 			if ($myrow = Database::fetch_array($result)) {
 				$category_title = $myrow["category_title"];
@@ -681,23 +681,23 @@ function get_cat($catname) {
 function put_link($url, $cat, $title, $description, $on_homepage, $hidden) {
 	$tbl_link = Database :: get_course_table(TABLE_LINK);
 
-	$urleq = "url='".addslashes($url)."'";
-	$cateq = "category_id=".$cat;
+	$urleq = "url='".Database::escape_string($url)."'";
+	$cateq = "category_id=".intval($cat);
 
 	$result = Database::query("SELECT id FROM $tbl_link WHERE ".$urleq.' AND '.$cateq);
 
 	if (Database::num_rows($result) >= 1 && ($row = Database::fetch_array($result))) {
-		Database::query("UPDATE $tbl_link set title='".addslashes($title)."', description='".addslashes($description)."' WHERE id='".addslashes($id = $row['id'])."'");
+		Database::query("UPDATE $tbl_link set title='".Database::escape_string($title)."', description='".Database::escape_string($description)."' WHERE id='".Database::escape_string($row['id'])."'");
 
 		$lang_link = get_lang('update_link');
 		$ipu = 'LinkUpdated';
 		$rv = 1; // 1 = upd
 	} else {
 		// Add new link
-		$result = Database::query("SELECT MAX(display_order) FROM  $tbl_link WHERE category_id='".addslashes($cat)."'");
+		$result = Database::query("SELECT MAX(display_order) FROM  $tbl_link WHERE category_id='".intval($cat)."'");
 		list ($max_order) = Database::fetch_row($result);
 
-		Database::query("INSERT INTO $tbl_link (url, title, description, category_id, display_order, on_homepage) VALUES ('".addslashes($url)."','".addslashes($title)."','".addslashes($description)."','".addslashes($cat)."','". ($max_order +1)."','".$on_homepage."')");
+		Database::query("INSERT INTO $tbl_link (url, title, description, category_id, display_order, on_homepage) VALUES ('".Database::escape_string($url)."','".Database::escape_string($title)."','".Database::escape_string($description)."','".intval($cat)."','". (intval($max_order) +1)."','".intval($on_homepage)."')");
 
 		$id = Database::insert_id();
 		$lang_link = get_lang('new_link');