Changeset 728 for trunk/phpbms/loadsearch.php

Timestamp:

01/07/10 12:45:17 (2 years ago)

Author:

brieb

Message:

• Fixed possible security loopholes in search screen (SQL Manipulation)

Files:

• trunk/phpbms/loadsearch.php (modified) (2 diffs)

trunk/phpbms/loadsearch.php

@@ -249 +249 @@
                                     </p>
                                     <p>
-                                            <textarea id="LSSQL" rows="8" cols="10" <?php if(!hasRights($tableinfo["advsearchroleid"])) echo " readonly=\"readonly\""?>></textarea>
+                                            <textarea id="LSSQL" name="LSSQL" rows="8" cols="10" <?php if(!hasRights($tableinfo["advsearchroleid"])) echo ' readonly="readonly"'?>></textarea>
                                     </p>
                             </td>
                             <td valign="top">
-                                    <p><br/><input id="LSLoad" type="button" onclick="LSRunSearch()" class="Buttons" disabled="disabled" value="run search"/></p>
+                                    <p><br/><input id="LSLoad" type="submit" name="command" class="Buttons" disabled="disabled" value="run search"/></p>
                                     <p><input id="LSDelete" type="button" onclick="LSDeleteSearch('<?php echo APP_PATH ?>')" class="Buttons" disabled="disabled" value="delete"/></p>
                                     <div id="LSResults">&nbsp;</div>
@@ -270 +270 @@
 if(isset($_GET["cmd"])){
 
+    require_once("include/session.php");
+
     $thesearch = new savedSearch($db);