blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-07-20 00:12:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Diverse SQL-Injection Lücken geschlossen

Browse Source
This commit is contained in:
Andreas Österreicher
2014-12-01 10:07:21 +00:00
parent 9325ebecbf
commit f670f45d2f
87 changed files with 4310 additions and 2015 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/benutzer.class.php
+6 -6
View File
@@ -92,7 +92,7 @@ class benutzer extends person
}
if($this->uid == '')
{
$this->errormsg = 'UID muss eingegeben werden '.$this->uid;
$this->errormsg = 'UID muss eingegeben werden';
return false;
}
if(mb_strlen($this->alias)>256)
@@ -199,7 +199,7 @@ class benutzer extends person
}
else
{
$this->errormsg = 'Fehler beim Speichern des Benutzer-Datensatzes:'.$qry;
$this->errormsg = 'Fehler beim Speichern des Benutzer-Datensatzes';
return false;
}
}
@@ -326,10 +326,10 @@ class benutzer extends person
elseif($aktiv==false)
$qry.=" tbl_benutzer.aktiv=false AND (";
$qry.=" lower(vorname || ' ' || nachname) like lower('%".addslashes(implode(' ',$searchItems))."%')";
$qry.=" OR lower(nachname || ' ' || vorname) like lower('%".addslashes(implode(' ',$searchItems))."%')";
$qry.=" OR lower(uid) like lower('%".addslashes(implode(' ',$searchItems))."%')";
$qry.=" OR lower(telefonklappe) like lower('%".addslashes(implode(' ',$searchItems))."%')";
$qry.=" lower(vorname || ' ' || nachname) like lower('%".$this->db_escape(implode(' ',$searchItems))."%')";
$qry.=" OR lower(nachname || ' ' || vorname) like lower('%".$this->db_escape(implode(' ',$searchItems))."%')";
$qry.=" OR lower(uid) like lower('%".$this->db_escape(implode(' ',$searchItems))."%')";
$qry.=" OR lower(telefonklappe) like lower('%".$this->db_escape(implode(' ',$searchItems))."%')";
foreach($searchItems as $value)
{