tyler.durden
/
pandorafms
mirror of https://github.com/pandorafms/pandorafms.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'ent-6278-SQL-Injection-ajax-cg_items' into 'develop' 

Solved ajax sql injection

Closes pandora_enterprise#6278

See merge request artica/pandorafms!3465
This commit is contained in:
Daniel Rodriguez 2020-09-22 12:15:43 +02:00
parent a38570c698 1258a1a635
commit bf1d3f4af3
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
pandora_console/general/cg_items.php
View File

@ -1,4 +1,5 @@
<?php
$stacked = db_get_sql('select stacked from tgraph where id_graph = '.$_GET['data']);
$num_items = db_get_sql('select count(*) from tgraph_source where id_graph = '.$_GET['data']);
$data = (int) get_parameter('data');
$stacked = db_get_sql('select stacked from tgraph where id_graph = '.$data);
$num_items = db_get_sql('select count(*) from tgraph_source where id_graph = '.$data);
echo "$stacked,$num_items";