blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-06-01 12:19:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

- include/filter.class.php -> loadValues now calls the superclass protected method replaceSQLDecryptionPassword to replace password variables with their values

Browse Source 
- include/statistik.class.php -> loadData now calls the superclass protected method replaceSQLDecryptionPassword to replace password variables with their values
- Added new functions hasSQLDecryption and isSQLDecryptionValid to include/functions.inc.php
- Script vilesci/statistik/filter_details.php and vilesci/stammdaten/statistik_details.php now do not allow to store SQL strings that contain PostgreSQL decryption functions using a clear password
This commit is contained in:
Paolo
2023-07-17 12:06:37 +02:00
parent 2cc0283d25
commit 75fb0f2d4a
5 changed files with 63 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/filter.class.php
+3 -1
View File
@@ -230,9 +230,11 @@ class filter extends basis_db
*/
public function loadValues($sql, $valuename, $showvalue)
{
$this->values = array();
// In case a decryption function is used then perform password substitution
$sql = $this->replaceSQLDecryptionPassword($sql);
if($this->db_query($sql))
{
while($row = $this->db_fetch_row())
include/functions.inc.php
+24
View File
@@ -1196,4 +1196,28 @@ function anzahlTage($date1, $date2)
$diff = $date2_ts - $date1_ts;
return round($diff / 86400);
}
/**
* Checks if the provided SQL string contains PostgreSQL functions to decrypt data, returns a boolean
*/
function hasSQLDecryption($sql)
{
return stripos($sql, 'PGP_SYM_DECRYPT') !== false;
}
/**
* Checks if the provided SQL string contains PostgreSQL functions to decrypt data,
* and if it is used a variable instead of a readable password. Returns a boolean
*/
function isSQLDecryptionValid($sql)
{
// If the SQL string contains decryption functions and there are _no_ password variables
if (hasSQLDecryption($sql) && strpos($sql, '${') === false)
{
return false; // then return false
}
return true; // in any other case return true
}
?>
include/statistik.class.php
+3
View File
@@ -514,6 +514,9 @@ class statistik extends basis_db
$this->countRows=0;
set_time_limit(120);
// In case a decryption function is used then perform password substitution
$this->sql = $this->replaceSQLDecryptionPassword($this->sql);
if($this->sql!='')
{
$sql = $this->sql;
vilesci/stammdaten/statistik_details.php
+22 -10
View File
@@ -26,6 +26,7 @@ require_once('../../config/vilesci.config.inc.php');
require_once('../../include/statistik.class.php');
require_once('../../include/benutzerberechtigung.class.php');
require_once('../../include/berechtigung.class.php');
require_once('../../include/functions.inc.php');
if(!$db = new basis_db())
{
@@ -140,18 +141,29 @@ if(!$rechte->isBerechtigt('basis/statistik', null, 'suid'))
$statistik->berechtigung_kurzbz = $berechtigung_kurzbz;
$statistik->preferences = $preferences;
$success = $statistik->save();
// Check if the SQL string contains functions to decrypt data and if there are
// variables to replace the value of the password (no clear password wanted!)
if (isSQLDecryptionValid($statistik->sql))
{
$success = $statistik->save();
if($success):
if($success):
?>
<span class="ok">Daten erfolgreich gespeichert</span>
<script type='text/javascript'>
parent.uebersicht_statistik.location.href = 'statistik_uebersicht.php';
</script>
<?php else: ?>
<span class="error"><?php echo $statistik->errormsg ?></span>
<?php
endif;
}
else // in case the SQL string is not valid display an error
{
?>
<span class="ok">Daten erfolgreich gespeichert</span>
<script type='text/javascript'>
parent.uebersicht_statistik.location.href = 'statistik_uebersicht.php';
</script>
<?php else: ?>
<span class="error"><?php echo $statistik->errormsg ?></span>
<?php
endif;
<span class="error"><?php echo 'It is not possible to store a SQL that contains clear passwords to decrypt data from the DB' ?></span>
<?php
}
}
$preferences = trim($statistik->preferences);
vilesci/statistik/filter_details.php
+11 -2
View File
@@ -76,9 +76,18 @@
$filter->type = $_POST["type"];
$filter->htmlattr = $_POST["htmlattr"];
if(!$filter->save())
// Check if the SQL string contains functions to decrypt data and if there are
// variables to replace the value of the password (no clear password wanted!)
if (isSQLDecryptionValid($filter->sql))
{
$errorstr .= $filter->errormsg;
if (!$filter->save())
{
$errorstr .= $filter->errormsg;
}
}
else
{
$errorstr .= 'It is not possible to store a SQL that contains clear passwords to decrypt data from the DB';
}
$reloadstr .= "<script type='text/javascript'>\n";