gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2025-05-11 20:21:16 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

turn some passed vars into integer if they are expected

Browse Source 
some where used in an sql statement and could be used for sql injection
This commit is contained in:
Uwe Steinmann 2018-06-27 18:51:59 +02:00
parent e3adcc2099
commit 952a1ad1fa
1 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
SeedDMS_Core/Core/inc.ClassUser.php
View File

@ -442,11 +442,12 @@ class SeedDMS_Core_User { /* {{{ */
function getRole() { return $this->_role; }
/**
* @param $newrole
* @param integer $newrole
* @return bool
*/
function setRole($newrole) { /* {{{ */
$db = $this->_dms->getDB();
$newrole = intval($newrole);
$queryStr = "UPDATE `tblUsers` SET `role` = " . $newrole . " WHERE `id` = " . $this->_id;
if (!$db->getResult($queryStr))
@ -589,7 +590,7 @@ class SeedDMS_Core_User { /* {{{ */
function getQuota() { return $this->_quota; }
/**
* @param $quota
* @param integer $quota
* @return bool
*/
function setQuota($quota) { /* {{{ */
@ -610,13 +611,14 @@ class SeedDMS_Core_User { /* {{{ */
function getHomeFolder() { return $this->_homeFolder; }
/**
* @param $homefolder
* @param integer $homefolder
* @return bool
*/
function setHomeFolder($homefolder) { /* {{{ */
$db = $this->_dms->getDB();
$homefolder = intval($homefolder);
$queryStr = "UPDATE `tblUsers` SET `homefolder` = " . ($homefolder ? (int) $homefolder : NULL) . " WHERE `id` = " . $this->_id;
$queryStr = "UPDATE `tblUsers` SET `homefolder` = " . ($homefolder ? $homefolder : NULL) . " WHERE `id` = " . $this->_id;
if (!$db->getResult($queryStr))
return false;
@ -1552,6 +1554,7 @@ class SeedDMS_Core_User { /* {{{ */
*/
function setMandatoryReviewer($id, $isgroup=false) { /* {{{ */
$db = $this->_dms->getDB();
$id = (int) $id;
if ($isgroup){
@ -1587,10 +1590,11 @@ class SeedDMS_Core_User { /* {{{ */
*/
function setMandatoryApprover($id, $isgroup=false) { /* {{{ */
$db = $this->_dms->getDB();
$id = (int) $id;
if ($isgroup){
$queryStr = "SELECT * FROM `tblMandatoryApprovers` WHERE `userID` = " . $this->_id . " AND `approverGroupID` = " . (int) $id;
$queryStr = "SELECT * FROM `tblMandatoryApprovers` WHERE `userID` = " . $this->_id . " AND `approverGroupID` = " . $id;
$resArr = $db->getResultArray($queryStr);
if (count($resArr)!=0) return true;
@ -1600,7 +1604,7 @@ class SeedDMS_Core_User { /* {{{ */
}else{
$queryStr = "SELECT * FROM `tblMandatoryApprovers` WHERE `userID` = " . $this->_id . " AND `approverUserID` = " . (int) $id;
$queryStr = "SELECT * FROM `tblMandatoryApprovers` WHERE `userID` = " . $this->_id . " AND `approverUserID` = " . $id;
$resArr = $db->getResultArray($queryStr);
if (count($resArr)!=0) return true;