tyler.durden/pandorafms
1
0
Fork 0
mirror of https://github.com/pandorafms/pandorafms.git synced 2025-04-08 18:55:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

#12798 fixed unauth sql injection in grafana

Browse Source
This commit is contained in:
Daniel Cebrian 2024-01-31 10:05:36 +01:00
parent f084893889
commit 137488ee8c
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
pandora_console/extensions/grafana/query.php
View File

@ -23,6 +23,9 @@ if ($headers['Authorization']) {
list($user, $password) = explode(':', base64_decode($headers['Authorization']));
// Prevent sql injection.
$user = mysqli_real_escape_string($config['dbconnection'], $user);
// Check user login
$user_in_db = process_user_login($user, $password, true);

3
pandora_console/extensions/grafana/search.php
View File

@ -24,6 +24,9 @@ if ($headers['Authorization']) {
list($user, $password) = explode(':', base64_decode($headers['Authorization']));
// Prevent sql injection.
$user = mysqli_real_escape_string($config['dbconnection'], $user);
// Check user login
$user_in_db = process_user_login($user, $password, true);