blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-07-21 17:02:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Diverse SQL-Injection Lücken geschlossen

Browse Source
This commit is contained in:
Andreas Österreicher
2014-12-01 10:07:21 +00:00
parent 9325ebecbf
commit f670f45d2f
87 changed files with 4310 additions and 2015 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/statistik.class.php
+22 -21
View File
@@ -161,7 +161,7 @@ class statistik extends basis_db
*/
public function getGruppe($gruppe,$publish=null)
{
$qry = "SELECT * FROM public.tbl_statistik WHERE gruppe='$gruppe'";
$qry = "SELECT * FROM public.tbl_statistik WHERE gruppe=".$this->db_add_param($gruppe);
if ($publish==true)
$qry.=' AND publish ';
elseif ($publish==false)
@@ -567,27 +567,28 @@ class statistik extends basis_db
{
return json_encode($this->json);
}
/**
*
* Parst Variablen aus einem String und liefert diese als Array zurueck
* @param $value String mit Variablen
* z.B.: "Select * from tbl_person where person_id<'$person_id'"
* oder "../content/statistik/bewerberstatistik.php?stsem=$StSem&stg_kz=$stg_kz"
*
* @return Array mit den Variablennamen
*/
function parseVars($value)
{
$result = array();
$check = '/\$[0-9A-z]+/';
preg_match_all($check, $value, $result);
$result = $result[0];
for($i=0;$i<count($result);$i++)
/**
*
* Parst Variablen aus einem String und liefert diese als Array zurueck
* @param $value String mit Variablen
* z.B.: "Select * from tbl_person where person_id<'$person_id'"
* oder "../content/statistik/bewerberstatistik.php?stsem=$StSem&stg_kz=$stg_kz"
*
* @return Array mit den Variablennamen
*/
function parseVars($value)
{
$result[$i] = mb_str_replace('$','',$result[$i]);
$result = array();
$check = '/\$[0-9A-z]+/';
preg_match_all($check, $value, $result);
$result = $result[0];
for($i=0;$i<count($result);$i++)
{
$result[$i] = mb_str_replace('$','',$result[$i]);
}
return array_unique($result);
}
return array_unique($result);
}
}