From 1258a1a63535f60924fb69b1f7812c678570cc8e Mon Sep 17 00:00:00 2001
From: Jose Gonzalez <jose.gonzalez@artica.es>
Date: Thu, 17 Sep 2020 15:14:03 +0200
Subject: [PATCH] Solved ajax sql injection

---
 pandora_console/general/cg_items.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pandora_console/general/cg_items.php b/pandora_console/general/cg_items.php
index 0c8aaa801c..844aac3270 100644
--- a/pandora_console/general/cg_items.php
+++ b/pandora_console/general/cg_items.php
@@ -1,4 +1,5 @@
 <?php
-$stacked = db_get_sql('select stacked from tgraph where id_graph = '.$_GET['data']);
-$num_items = db_get_sql('select count(*) from tgraph_source where id_graph = '.$_GET['data']);
+$data = (int) get_parameter('data');
+$stacked = db_get_sql('select stacked from tgraph where id_graph = '.$data);
+$num_items = db_get_sql('select count(*) from tgraph_source where id_graph = '.$data);
 echo "$stacked,$num_items";