blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-07-20 00:12:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

system/Variable_model: replaced concatenation of names array with ? (parameter replacement by CI) to prevent SQL injections

Browse Source
This commit is contained in:
alex
2020-02-06 14:52:26 +01:00
parent 17ef2f173b
commit 7f8415e6dc
2 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/models/system/Variable_model.php
+11 -10
View File
@@ -24,30 +24,32 @@ class Variable_model extends DB_Model
*/
public function getVariables($uid, $names = null)
{
if (isEmptyString($uid) || (isset($names) && !is_array($names)))
if (isEmptyString($uid))
$result = error('wrong parameters passed');
else
{
$vardata = array();
$parametersArray = array($uid);
$qry = "SELECT name, wert FROM public.tbl_variable WHERE uid = ?";
if (isset($names))
if (!isEmptyArray($names))
{
$qry .= " AND name IN ('".implode(',', $names)."')";
$qry .= " AND name IN ?";
$parametersArray[] = $names;
}
$qry .= ";";
$varresults = $this->execQuery($qry, array($uid));
$varresults = $this->execQuery($qry, $parametersArray);
if (hasData($varresults))
{
$varresults = getData($varresults);
foreach ($varresults as $varresult)
{
if (isset($varresult->wert))
$vardata[$varresult->name] = $varresult->wert;
}
foreach ($varresults as $varresult)
{
if (isset($varresult->wert))
$vardata[$varresult->name] = $varresult->wert;
}
}
$vardefaults = $this->VariablennameModel->getDefaults($names);
@@ -56,7 +58,6 @@ class Variable_model extends DB_Model
{
$vardefaults = getData($vardefaults);
foreach ($vardefaults as $vardefault)
{
if (!isset($vardata[$vardefault->name]) && isset($vardefault->defaultwert))