mirror/librenms-librenms
1
0
Fork 0
mirror of https://github.com/librenms/librenms.git synced 2024-10-07 16:52:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix SQL injections in ajax_table.php (#11920)

Browse Source 
* Fix SQL injections via searchPhrase parameter

* Fix SQL injections via address parameter

* Fix sort injection

Co-authored-by: Tony Murray <murraytony@gmail.com>
This commit is contained in:
Jellyfrog
2020-07-10 16:17:09 +02:00
committed by GitHub
parent 290398bd9b
commit 32f72bc1ab
20 changed files with 90 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
includes/html/table/processor.inc.php
View File

@@ -28,7 +28,9 @@ if (!Auth::user()->hasGlobalRead()) {
$sql .= " WHERE $where";
if (isset($searchPhrase) && !empty($searchPhrase)) {
$sql .= " AND (`hostname` LIKE '%$searchPhrase%' OR `processor_descr` LIKE '%$searchPhrase%')";
$sql .= " AND (`hostname` LIKE ? OR `processor_descr` LIKE ?)";
$param[] = "%$searchPhrase%";
$param[] = "%$searchPhrase%";
}
$count_sql = "SELECT COUNT(`processor_id`) $sql";