tyler.durden
/
pandorafms
mirror of https://github.com/pandorafms/pandorafms.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fixed unauth sql injection in grafana

This commit is contained in:
Daniel Cebrian 2024-01-31 10:05:36 +01:00
parent f084893889
commit 137488ee8c
2 changed files with 6 additions and 0 deletions
pandora_console/extensions/grafana
query.phpsearch.php

3
pandora_console/extensions/grafana/query.php
View File

@ -23,6 +23,9 @@ if ($headers['Authorization']) {
list($user, $password) = explode(':', base64_decode($headers['Authorization']));
// Prevent sql injection.
$user = mysqli_real_escape_string($config['dbconnection'], $user);
// Check user login
$user_in_db = process_user_login($user, $password, true);

3
pandora_console/extensions/grafana/search.php
View File

@ -24,6 +24,9 @@ if ($headers['Authorization']) {
list($user, $password) = explode(':', base64_decode($headers['Authorization']));
// Prevent sql injection.
$user = mysqli_real_escape_string($config['dbconnection'], $user);
// Check user login
$user_in_db = process_user_login($user, $password, true);