Changeset 725

Timestamp:

01/06/10 22:48:56 (2 years ago)

Author:

brieb

Message:

• Fixed more path disclosure and possible SQL injection bugs in the load search class

Location:

trunk/phpbms

Files:

• include/common_functions.php (modified) (1 diff)
• loadsearch.php (modified) (3 diffs)
• modules/bms/include/invoices.php (modified) (1 diff)

trunk/phpbms/include/common_functions.php

@@ -304 +304 @@
                         `".$tablerecord["maintable"]."`
                 WHERE
-                        `id` = ".$id;
+                        `id` = ".((int) $id);
 
         $queryresult = $db->query($querystatement);

trunk/phpbms/loadsearch.php

@@ -66 +66 @@
 
                         $uuid = getUuid($this->db, "tbld:5c9d645f-26ab-5003-b98e-89e9049f8ac3", $tabledefid);
-                        
+
                         $querystatement = "
                 SELECT
@@ -75 +75 @@
                     `uuid` = '".$uuid."'
             ";
-            
+
             $queryresult = $this->db->query($querystatement);
-            
+
             $therecord = $this->db->fetchArray($queryresult);
             $prefix = $therecord["prefix"];
@@ -265 +265 @@
 
 
-        if(isset($_GET["cmd"])){
-
-                $thesearch = new savedSearch($db);
-
-                switch($_GET["cmd"]){
-                        case "show":
-                                $securitywhere = "";
-
-                                if ($_SESSION["userinfo"]["admin"]!=1 && count($_SESSION["userinfo"]["roles"])>0){
-
-                                        $securitywhere = "";
-
-                                        foreach($_SESSION["userinfo"]["roles"] as $role)
-                                                $securitywhere .= ", '".$role."'";
-
-                                        $securitywhere = " AND (`roleid` IN (''".$securitywhere.") OR `roleid` IS NULL)";
-
-                                }//endif
-
-                                $thesearch->showLoad($_GET["tid"], $_SESSION["userinfo"]["uuid"], $securitywhere);
-                                break;
-
-                        case "getsearch":
-                                $thesearch->get($_GET["id"]);
-                        break;
-                        case "savesearch":
-                                $thesearch->save($_GET["name"],$_GET["tid"],$_SESSION["userinfo"]["uuid"]);
-                        break;
-                        case "deletesearch":
-                                $thesearch->delete($_GET["id"]);
-                        break;
-                }//end switch
-        }?>
+if(isset($_GET["cmd"])){
+
+    $thesearch = new savedSearch($db);
+
+    switch($_GET["cmd"]){
+
+            case "show":
+
+                $securitywhere = "";
+
+                if ($_SESSION["userinfo"]["admin"]!=1 && count($_SESSION["userinfo"]["roles"])>0){
+
+                    $securitywhere = "";
+
+                    foreach($_SESSION["userinfo"]["roles"] as $role)
+                        $securitywhere .= ", '".$role."'";
+
+                    $securitywhere = " AND (`roleid` IN (''".$securitywhere.") OR `roleid` IS NULL)";
+
+                }//endif
+
+                if(!isset($_GET["tid"]))
+                    $error = new appError(200, "passed parameters not set");
+
+                $thesearch->showLoad($_GET["tid"], $_SESSION["userinfo"]["uuid"], $securitywhere);
+                break;
+
+            case "getsearch":
+
+                if(!isset($_GET["id"]))
+                    $error = new appError(200, "passed parameters not set");
+
+                $thesearch->get($_GET["id"]);
+                break;
+
+            case "savesearch":
+
+                if(!isset($_GET["tid"]) || !isset($_GET["name"]))
+                    $error = new appError(200, "passed parameters not set");
+
+                $thesearch->save($_GET["name"] ,$_GET["tid"], $_SESSION["userinfo"]["uuid"]);
+                break;
+
+            case "deletesearch":
+
+                if(!isset($_GET["id"]))
+                    $error = new appError(200, "passed parameters not set");
+
+                $thesearch->delete($_GET["id"]);
+                break;
+
+    }//end switch
+
+}//endif
+?>

trunk/phpbms/modules/bms/include/invoices.php

@@ -649 +649 @@
                         $therecord = parent::getRecord($id, $useUuid);
 
+                        if(!$therecord["id"])
+                            $error = new appError(430, "Sales Order record '".$id."' does not exist", "No Record Available", true, true);
+
                         /**
                           *  If `type` is not an order and not a quote and payment information is being