ThaMunsta/itflow
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security Added some mysql escapes to some get vars in api and guest view invoice and quote

Browse Source
This commit is contained in:
johnny@pittpc.com
2019-08-28 21:54:27 -04:00
parent 0e451056b4
commit bbf8756882
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
api.php
View File

@@ -3,7 +3,7 @@
<?php <?php
//Check Key //Check Key
if(isset($_GET['api_key'])){ if(isset($_GET['api_key'])){
$config_api_key = $_GET['api_key']; $config_api_key = mysqli_real_escape_string($mysqli,$_GET['api_key']);
$sql = mysqli_query($mysqli,"SELECT * FROM settings, companies WHERE settings.company_id = companies.company_id AND settings.config_api_key = '$config_api_key'"); $sql = mysqli_query($mysqli,"SELECT * FROM settings, companies WHERE settings.company_id = companies.company_id AND settings.config_api_key = '$config_api_key'");

2
guest_view_invoice.php
View File

@@ -4,7 +4,7 @@
if(isset($_GET['invoice_id'], $_GET['url_key'])){ if(isset($_GET['invoice_id'], $_GET['url_key'])){
$url_key = $_GET['url_key']; $url_key = mysqli_real_escape_string($mysqli,$_GET['url_key']);
$invoice_id = intval($_GET['invoice_id']); $invoice_id = intval($_GET['invoice_id']);
$sql = mysqli_query($mysqli,"SELECT * FROM invoices, clients $sql = mysqli_query($mysqli,"SELECT * FROM invoices, clients

2
guest_view_quote.php
View File

@@ -4,7 +4,7 @@
if(isset($_GET['quote_id'], $_GET['url_key'])){ if(isset($_GET['quote_id'], $_GET['url_key'])){
$url_key = $_GET['url_key']; $url_key = mysqli_real_escape_string($mysqli,$_GET['url_key']);
$quote_id = intval($_GET['quote_id']); $quote_id = intval($_GET['quote_id']);
$sql = mysqli_query($mysqli,"SELECT * FROM quotes, clients $sql = mysqli_query($mysqli,"SELECT * FROM quotes, clients