Merge branch 'ent-5910-bug-sql-query-report-illegal-words' into 'develop'
Modified match for forbidden words. Now not allows spaces or scaped chars.... Closes pandora_enterprise#5910 See merge request artica/pandorafms!3277
This commit is contained in:
commit
8ebf7b34f2
|
@ -2142,7 +2142,7 @@ function check_sql($sql)
|
|||
{
|
||||
// We remove "*" to avoid things like SELECT * FROM tusuario
|
||||
// Check that it not delete_ as "delete_pending" (this is a common field in pandora tables).
|
||||
if (preg_match('/\*|delete[^_]|drop|alter|modify|password|pass|insert|update/i', $sql)) {
|
||||
if (preg_match('/([ ]*(delete|drop|alter|modify|password|pass|insert|update)\b[ \\]+)/i', $sql)) {
|
||||
return '';
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue