Merge branch 'ent-5322-SQL-Injection-leads-to-Login-Bypass' into 'develop'

Fixed injection sql in chart_generator See merge request artica/pandorafms!3024
2020-01-24 10:52:02 +01:00 · 2020-01-24 10:52:02 +01:00 · 6a35ffa01b
parent ea3a317a1b 9f9cc9beda
commit 6a35ffa01b
1 changed files with 1 additions and 1 deletions
--- a/pandora_console/include/lib/User.php
+++ b/pandora_console/include/lib/User.php
@ -70,7 +70,7 @@ class User
                $this->sessions[$data['phpsessionid']] = 1;
                $info = \db_get_row_filter(
                    'tsessions_php',
-                    ['id_session' => $data['phpsessionid']]
+                    ['id_session' => io_safe_input($data['phpsessionid'])]
                );

                if ($info !== false) {