Changeset 728 for trunk

Timestamp:

01/07/10 12:45:17 (2 years ago)

Author:

brieb

Message:

• Fixed possible security loopholes in search screen (SQL Manipulation)

Location:

trunk/phpbms

Files:

• common/javascript/queryfunctions.js (modified) (2 diffs)
• include/relationships.php (modified) (1 diff)
• include/search_class.php (modified) (1 diff)
• loadsearch.php (modified) (2 diffs)
• search.php (modified) (4 diffs)

trunk/phpbms/common/javascript/queryfunctions.js

@@ -77 +77 @@
                 } else
                     ctrlkeydown = theevent.metaKey;
-                    
+
                 shiftkeydown=theevent.shiftKey;
         }
@@ -610 +610 @@
 }
 
-function LSRunSearch(){
-        var sqlbox=getObjectFromID("LSSQL");
-        var advancedsearch=getObjectFromID("advancedsearch");
-        advancedsearch.value=sqlbox.value
-        advancedsearch.form.submit();
-}
 function LSDeleteSearch(base){
         var theselect=getObjectFromID("LSList");

trunk/phpbms/include/relationships.php

@@ -102 +102 @@
         */
         foreach($theids as $theid)
-            $_SESSION["passedjoinwhere"] .= " OR ".$therecord["fromtable"].".id = ".$theid;
+            $_SESSION["passedjoinwhere"] .= " OR ".$therecord["fromtable"].".id = ".((int) $theid);
 
         $_SESSION["passedjoinwhere"] = substr($_SESSION["passedjoinwhere"], 3);

trunk/phpbms/include/search_class.php

@@ -81 +81 @@
                                         searchroleid,
                                         advsearchroleid,
-                                        viewsqlroleid
+                                        viewsqlroleid,
+                                        editroleid,
+                                        addroleid
                                 FROM
-                                        tabledefs inner join modules on tabledefs.moduleid = modules.uuid
+                                        tabledefs INNER JOIN modules on tabledefs.moduleid = modules.uuid
                                 WHERE
                                         tabledefs.uuid= '".$id."'";

trunk/phpbms/loadsearch.php

@@ -249 +249 @@
                                     </p>
                                     <p>
-                                            <textarea id="LSSQL" rows="8" cols="10" <?php if(!hasRights($tableinfo["advsearchroleid"])) echo " readonly=\"readonly\""?>></textarea>
+                                            <textarea id="LSSQL" name="LSSQL" rows="8" cols="10" <?php if(!hasRights($tableinfo["advsearchroleid"])) echo ' readonly="readonly"'?>></textarea>
                                     </p>
                             </td>
                             <td valign="top">
-                                    <p><br/><input id="LSLoad" type="button" onclick="LSRunSearch()" class="Buttons" disabled="disabled" value="run search"/></p>
+                                    <p><br/><input id="LSLoad" type="submit" name="command" class="Buttons" disabled="disabled" value="run search"/></p>
                                     <p><input id="LSDelete" type="button" onclick="LSDeleteSearch('<?php echo APP_PATH ?>')" class="Buttons" disabled="disabled" value="delete"/></p>
                                     <div id="LSResults">&nbsp;</div>
@@ -270 +270 @@
 if(isset($_GET["cmd"])){
 
+    require_once("include/session.php");
+
     $thesearch = new savedSearch($db);
 

trunk/phpbms/search.php

@@ -41 +41 @@
 
         if(!isset($_GET["id"]))
-                $error = new appError(100,"Passed Parameter not present.");
-
-        $_GET["id"]= mysql_real_escape_string($_GET["id"]);
+            $error = new appError(100,"Passed Parameter not present.");
+
+        $_GET["id"] = mysql_real_escape_string($_GET["id"]);
 
         $displayTable= new displaySearchTable($db);
@@ -109 +109 @@
                                 $querystatement = "
                                         SELECT
-                                                name
+                                                name,
+                                                roleid
                                         FROM
                                                 tableoptions
@@ -169 +170 @@
                         // omit selected from current query
                         //=====================================================================================================
-                        $displayTable->recordoffset=0;
-                        $tempwhere="";
-                        $theids=explode(",",$_POST["theids"]);
-                        foreach($theids as $theid){
-                                $tempwhere.=" or ".$displayTable->thetabledef["maintable"].".id=".$theid;
-                        }
-                        $tempwhere=substr($tempwhere,3);
-                        $displayTable->querywhereclause="(".$displayTable->querywhereclause.") and not (".$tempwhere.")";
+                        $displayTable->recordoffset = 0;
+                        $tempwhere = "";
+                        $theids = explode(",",$_POST["theids"]);
+
+                        foreach($theids as $theid)
+                            $tempwhere.=" OR ".$displayTable->thetabledef["maintable"].".id=".((int) $theid);
+
+                        $tempwhere = substr($tempwhere,3);
+
+                        $displayTable->querywhereclause="(".$displayTable->querywhereclause.") AND NOT (".$tempwhere.")";
                         break;
 
@@ -182 +185 @@
                         // keep only those ids
                         //=====================================================================================================
-                        $displayTable->recordoffset=0;
-                        $tempwhere="";
-                        $theids=explode(",",$_POST["theids"]);
-                        foreach($theids as $theid){
-                                $tempwhere.=" or ".$displayTable->thetabledef["maintable"].".id=".$theid;
-                        }
+                        $displayTable->recordoffset = 0;
+                        $tempwhere = "";
+                        $theids = explode(",",$_POST["theids"]);
+
+                        foreach($theids as $theid)
+                            $tempwhere.=" or ".$displayTable->thetabledef["maintable"].".id=".((int) $theid);
+
                         $tempwhere=substr($tempwhere,3);
-                        $displayTable->querywhereclause=$tempwhere;
+
+                        $displayTable->querywhereclause = $tempwhere;
+
                         break;
 
                 case "advanced search":
+
+                        if(!hasRights($displayTable->thetabledef["advsearchroleid"]))
+                            goURL(APP_PATH."noaccess.php");
+
                         $displayTable->recordoffset=0;
                         $displayTable->querywhereclause=stripslashes($_POST["advancedsearch"]);
                         $displayTable->querytype="advanced search";
                         break;
+
+                case "run search":
+                    /**
+                     * Run a loaded search
+                     */
+
+                        if(!hasRights($displayTable->thetabledef["advsearchroleid"])){
+                            /**
+                             * Need to load search from id, because the
+                             * person does not have rights to override loaded
+                             * searches
+                             */
+
+                            $querystatement="
+                                SELECT
+                                        sqlclause
+                                FROM
+                                        usersearches
+                                WHERE id=".((int) $_POST["LSList"]);
+
+                            $queryresult = $db->query($querystatement);
+
+                            $therecord = $db->fetchArray($queryresult);
+
+                            $_POST["LSSQL"] = $therecord["sqlclause"];
+
+                        }//endif
+
+                        $displayTable->recordoffset=0;
+                        $displayTable->querywhereclause=stripslashes($_POST["LSSQL"]);
+                        $displayTable->querytype="advanced search";
+                        break;
+                    break;
 
                 case "advanced sort":
                         $displayTable->showGroupings = 0;
                         $displayTable->recordoffset = 0;
-                        $displayTable->querysortorder=$_POST["advancedsort"];
+                        $displayTable->querysortorder = $_POST["advancedsort"];
                         break;