tyler.durden/pandorafms
1
0
Fork 0
mirror of https://github.com/pandorafms/pandorafms.git synced 2025-09-25 19:09:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

2014-01-20 Miguel de Dios <miguel.dedios@artica.es>

Browse Source 
* mobile/include/user.class.php,
	mobile/include/system.class.php: fixed SQL injection.
	
	Issue found by Lincoln, a member of Corelan Team




git-svn-id: https://svn.code.sf.net/p/pandora/code/trunk@9344 c3f86ba8-e40f-0410-aaad-9ba5e7f4b01f
This commit is contained in:
mdtrooper 2014-01-20 12:05:03 +00:00
parent e36e7d41b7
commit 17c6d55fd6
3 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
pandora_console/ChangeLog
View File

@ -1,3 +1,10 @@
2014-01-20 Miguel de Dios <miguel.dedios@artica.es>
* mobile/include/user.class.php,
mobile/include/system.class.php: fixed SQL injection.
Issue found by Lincoln, a member of Corelan Team
2014-01-17 Juan Manuel Ramon Vigo <juanmanuel.ramon@artica.es> 2014-01-17 Juan Manuel Ramon Vigo <juanmanuel.ramon@artica.es>
* godmode/reporting/reporting_builder.php: Fixed group filter in report * godmode/reporting/reporting_builder.php: Fixed group filter in report

12
pandora_console/mobile/include/system.class.php
View File

@ -62,6 +62,18 @@ class System {
return $return; return $return;
} }
public function safeOutput($value) {
require_once($this->getConfig('homedir') . '/include/functions_io.php');
return io_safe_output($value);
}
public function safeInput($value) {
require_once($this->getConfig('homedir') . '/include/functions_io.php');
return io_safe_input($value);
}
public function getConfig($name, $default = null) { public function getConfig($name, $default = null) {
if (!isset($this->config[$name])) { if (!isset($this->config[$name])) {
return $default; return $default;

3
pandora_console/mobile/include/user.class.php
View File

@ -87,16 +87,19 @@ class User {
if (($user == null) && ($password == null)) { if (($user == null) && ($password == null)) {
$user = $system->getRequest('user', null); $user = $system->getRequest('user', null);
$user = $system->safeInput($user);
$password = $system->getRequest('password', null); $password = $system->getRequest('password', null);
} }
if (!empty($user) && !empty($password)) { if (!empty($user) && !empty($password)) {
if (process_user_login($user, $password) !== false) { if (process_user_login($user, $password) !== false) {
$this->logged = true; $this->logged = true;
$this->user = $user; $this->user = $user;
$this->errorLogin = false; $this->errorLogin = false;
} }
else { else {
$this->logged = false; $this->logged = false;
$this->errorLogin = true; $this->errorLogin = true;
} }