gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2025-05-14 13:42:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

turn some passed vars into integer if they are expected

Browse Source 
some where used in an sql statement and could be used for sql injection
This commit is contained in:
Uwe Steinmann 2018-06-27 18:51:59 +02:00
parent e3adcc2099
commit 952a1ad1fa
1 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
SeedDMS_Core/Core/inc.ClassUser.php
View File

@ -442,11 +442,12 @@ class SeedDMS_Core_User { /* {{{ */
function getRole() { return $this->_role; } function getRole() { return $this->_role; }
/** /**
* @param $newrole * @param integer $newrole
* @return bool * @return bool
*/ */
function setRole($newrole) { /* {{{ */ function setRole($newrole) { /* {{{ */
$db = $this->_dms->getDB(); $db = $this->_dms->getDB();
$newrole = intval($newrole);
$queryStr = "UPDATE `tblUsers` SET `role` = " . $newrole . " WHERE `id` = " . $this->_id; $queryStr = "UPDATE `tblUsers` SET `role` = " . $newrole . " WHERE `id` = " . $this->_id;
if (!$db->getResult($queryStr)) if (!$db->getResult($queryStr))
@ -589,7 +590,7 @@ class SeedDMS_Core_User { /* {{{ */
function getQuota() { return $this->_quota; } function getQuota() { return $this->_quota; }
/** /**
* @param $quota * @param integer $quota
* @return bool * @return bool
*/ */
function setQuota($quota) { /* {{{ */ function setQuota($quota) { /* {{{ */
@ -610,13 +611,14 @@ class SeedDMS_Core_User { /* {{{ */
function getHomeFolder() { return $this->_homeFolder; } function getHomeFolder() { return $this->_homeFolder; }
/** /**
* @param $homefolder * @param integer $homefolder
* @return bool * @return bool
*/ */
function setHomeFolder($homefolder) { /* {{{ */ function setHomeFolder($homefolder) { /* {{{ */
$db = $this->_dms->getDB(); $db = $this->_dms->getDB();
$homefolder = intval($homefolder);
$queryStr = "UPDATE `tblUsers` SET `homefolder` = " . ($homefolder ? (int) $homefolder : NULL) . " WHERE `id` = " . $this->_id; $queryStr = "UPDATE `tblUsers` SET `homefolder` = " . ($homefolder ? $homefolder : NULL) . " WHERE `id` = " . $this->_id;
if (!$db->getResult($queryStr)) if (!$db->getResult($queryStr))
return false; return false;
@ -1552,6 +1554,7 @@ class SeedDMS_Core_User { /* {{{ */
*/ */
function setMandatoryReviewer($id, $isgroup=false) { /* {{{ */ function setMandatoryReviewer($id, $isgroup=false) { /* {{{ */
$db = $this->_dms->getDB(); $db = $this->_dms->getDB();
$id = (int) $id;
if ($isgroup){ if ($isgroup){
@ -1587,10 +1590,11 @@ class SeedDMS_Core_User { /* {{{ */
*/ */
function setMandatoryApprover($id, $isgroup=false) { /* {{{ */ function setMandatoryApprover($id, $isgroup=false) { /* {{{ */
$db = $this->_dms->getDB(); $db = $this->_dms->getDB();
$id = (int) $id;
if ($isgroup){ if ($isgroup){
$queryStr = "SELECT * FROM `tblMandatoryApprovers` WHERE `userID` = " . $this->_id . " AND `approverGroupID` = " . (int) $id; $queryStr = "SELECT * FROM `tblMandatoryApprovers` WHERE `userID` = " . $this->_id . " AND `approverGroupID` = " . $id;
$resArr = $db->getResultArray($queryStr); $resArr = $db->getResultArray($queryStr);
if (count($resArr)!=0) return true; if (count($resArr)!=0) return true;
@ -1600,7 +1604,7 @@ class SeedDMS_Core_User { /* {{{ */
}else{ }else{
$queryStr = "SELECT * FROM `tblMandatoryApprovers` WHERE `userID` = " . $this->_id . " AND `approverUserID` = " . (int) $id; $queryStr = "SELECT * FROM `tblMandatoryApprovers` WHERE `userID` = " . $this->_id . " AND `approverUserID` = " . $id;
$resArr = $db->getResultArray($queryStr); $resArr = $db->getResultArray($queryStr);
if (count($resArr)!=0) return true; if (count($resArr)!=0) return true;