blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-07-25 00:24:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Diverse SQL-Injection Lücken geschlossen

Browse Source
This commit is contained in:
Andreas Österreicher
2014-12-01 10:07:21 +00:00
parent 9325ebecbf
commit f670f45d2f
87 changed files with 4310 additions and 2015 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cis/private/tools/feedback.php
+8 -8
View File
@@ -25,12 +25,12 @@
/*
* Formular zum Senden eins Feedbacks an die CIS-Administratoren
*/
require_once('../../../config/cis.config.inc.php');
require_once('../../../include/basis_db.class.php');
require_once('../../../include/functions.inc.php');
require_once('../../../include/mail.class.php');
require_once('../../../include/phrasen.class.php');
require_once('../../../config/cis.config.inc.php');
require_once('../../../include/basis_db.class.php');
require_once('../../../include/functions.inc.php');
require_once('../../../include/mail.class.php');
require_once('../../../include/phrasen.class.php');
$sprache = getSprache();
$p=new phrasen($sprache);
@@ -49,7 +49,7 @@ if (!$user=get_uid())
{
$destination = MAIL_CIS;
$sql_query = "SELECT DISTINCT vorname, nachname, (uid || '@".DOMAIN."') AS emailtw FROM campus.vw_benutzer WHERE uid='$user' LIMIT 1";
$sql_query = "SELECT DISTINCT vorname, nachname, (uid || '@".DOMAIN."') AS emailtw FROM campus.vw_benutzer WHERE uid=".$db->db_add_param($user)." LIMIT 1";
$feedback_message = chop($txtFeedbackMessage);
@@ -151,4 +151,4 @@ if (!$user=get_uid())
</tr>
</table>
</body>
</html>
</html>