blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-07-26 00:54:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Diverse SQL-Injection Lücken geschlossen

Browse Source
This commit is contained in:
Andreas Österreicher
2014-12-01 10:07:21 +00:00
parent 9325ebecbf
commit f670f45d2f
87 changed files with 4310 additions and 2015 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cis/private/pdfExport.php
+3 -3
View File
@@ -114,7 +114,7 @@ if (($user == $_GET["uid"]) || $rechte->isBerechtigt('admin'))
//echo ':'.$xml_doc->saveXML().':';
//XSL aus der DB holen
$qry = "SELECT text FROM public.tbl_vorlagestudiengang WHERE (studiengang_kz=0 OR studiengang_kz='".addslashes($xsl_stg_kz)."') AND vorlage_kurzbz='$xsl' ORDER BY studiengang_kz DESC, version DESC LIMIT 1";
$qry = "SELECT text FROM public.tbl_vorlagestudiengang WHERE (studiengang_kz=0 OR studiengang_kz=".$db->db_add_param($xsl_stg_kz).") AND vorlage_kurzbz=".$db->db_add_param($xsl)." ORDER BY studiengang_kz DESC, version DESC LIMIT 1";
if(!$result = $db->db_query($qry))
die('Fehler beim laden der Vorlage'.$db->db_last_error());
@@ -145,7 +145,7 @@ if (($user == $_GET["uid"]) || $rechte->isBerechtigt('admin'))
if(isset($_GET['uid']) && $_GET['uid']!='')
{
$uid = str_replace(';','',$_GET['uid']);
$qry = "SELECT nachname FROM campus.vw_benutzer WHERE uid='".addslashes($uid)."'";
$qry = "SELECT nachname FROM campus.vw_benutzer WHERE uid=".$db->db_add_param($uid);
if($result = $db->db_query($qry))
{
@@ -167,4 +167,4 @@ else
// kein berechtigung
echo "<html><body><h3>Sie haben keine Berechtigung zum Anzeigen dieser Seite</h3></body></html>";
}
?>
?>