From 7f8415e6dc78f1bd3fa8b1b8c6629f7ff2c43af1 Mon Sep 17 00:00:00 2001
From: alex <karpen_ko@hotmail.com>
Date: Thu, 6 Feb 2020 14:52:26 +0100
Subject: [PATCH] system/Variable_model: replaced concatenation of names array
 with ? (parameter replacement by CI) to prevent SQL injections

---
 application/libraries/VariableLib.php        |  2 +-
 application/models/system/Variable_model.php | 21 ++++++++++----------
 2 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/application/libraries/VariableLib.php b/application/libraries/VariableLib.php
index 3d732984f..2f038531b 100644
--- a/application/libraries/VariableLib.php
+++ b/application/libraries/VariableLib.php
@@ -57,7 +57,7 @@ class VariableLib
 
 		if (!isEmptyString($uid) && !isEmptyString($name) && is_numeric($change))
 		{
-			$change = (int) $change;
+			$change = (int)$change;
 			$varres = $this->_ci->VariableModel->getVariables($uid, array($name));
 
 			if (isSuccess($varres))
diff --git a/application/models/system/Variable_model.php b/application/models/system/Variable_model.php
index 1fcb5b274..875fc8876 100644
--- a/application/models/system/Variable_model.php
+++ b/application/models/system/Variable_model.php
@@ -24,30 +24,32 @@ class Variable_model extends DB_Model
 	 */
 	public function getVariables($uid, $names = null)
 	{
-		if (isEmptyString($uid) || (isset($names) && !is_array($names)))
+		if (isEmptyString($uid))
 			$result = error('wrong parameters passed');
 		else
 		{
 			$vardata = array();
+			$parametersArray = array($uid);
 
 			$qry = "SELECT name, wert FROM public.tbl_variable WHERE uid = ?";
 
-			if (isset($names))
+			if (!isEmptyArray($names))
 			{
-				$qry .= " AND name IN ('".implode(',', $names)."')";
+				$qry .= " AND name IN ?";
+				$parametersArray[] = $names;
 			}
 			$qry .= ";";
 
-			$varresults = $this->execQuery($qry, array($uid));
+			$varresults = $this->execQuery($qry, $parametersArray);
 
 			if (hasData($varresults))
 			{
 				$varresults = getData($varresults);
-					foreach ($varresults as $varresult)
-					{
-						if (isset($varresult->wert))
-							$vardata[$varresult->name] = $varresult->wert;
-					}
+				foreach ($varresults as $varresult)
+				{
+					if (isset($varresult->wert))
+						$vardata[$varresult->name] = $varresult->wert;
+				}
 			}
 
 			$vardefaults = $this->VariablennameModel->getDefaults($names);
@@ -56,7 +58,6 @@ class Variable_model extends DB_Model
 			{
 				$vardefaults = getData($vardefaults);
 
-
 				foreach ($vardefaults as $vardefault)
 				{
 					if (!isset($vardata[$vardefault->name]) && isset($vardefault->defaultwert))