tyler.durden
/
pandorafms
mirror of https://github.com/pandorafms/pandorafms.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added restriction to dangerous querys (drop database).

This commit is contained in:
Arturo Gonzalez 2016-07-19 13:48:56 +02:00
parent 8c20874a88
commit eefb094df6
1 changed files with 59 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
pandora_console/include/ajax/rolling_release.ajax.php
View File

@ -27,6 +27,24 @@ if (is_ajax ()) {
$dir = $config["homedir"]."/extras/mr";
$file = "$dir/$number.open.sql";
$dangerous_query = false;
$mr_file = fopen($file, "r");
while (!feof($mr_file)) {
$line = fgets($mr_file);
if ((preg_match("/^drop/", $line)) ||
(preg_match("/^DROP/", $line))) {
$dangerous_query = true;
}
}
if ($dangerous_query) {
$error_file = fopen($config["homedir"] . "/extras/mr/error.txt", "w");
$message = "The sql file contains a dangerous query";
fwrite($error_file, $message);
fclose($error_file);
}
else {
if (file_exists($dir) && is_dir($dir)) {
if (is_readable($dir)) {
if ($config["minor_release_open"] >= $number) {
@ -80,6 +98,7 @@ if (is_ajax ()) {
fwrite($error_file, $message);
fclose($error_file);
}
}
echo $message;
return;