Navigation

Changeset 6563

Timestamp:

09/04/08 14:43:50 (3 months ago)

Author:

p_lindheimer

Message:

fix SECURITY SQL Injection vulnerability that could allow an authenticated user to access CDR and recorded calls from any other user on the system

Files:

r6478	r6563
204	204
205	205	// table body
206		foreach($data as $key=>$value) {
	206	if (is_array($data)) foreach($data as $key=>$value) {
207	207
208	208	// recording file
…	…
387	387	}
388	388
389		foreach($data as $data_key => $data_value) {
	389	if (is_array($data)) foreach($data as $data_key => $data_value) {
390	390
391	391	$recording='';
…	…
555	555	// search text
556	556	if ($q!='*' && $q!=NULL) {
	557
	558	$dbh = $_SESSION['dbh_cdr'];
557	559	$searchText .= "WHERE ";
558	560	$tok = strtok($q," \n\t");
	561	$tok = $dbh->escapeSimple($tok);
559	562	while ($tok) {
560	563	$searchText .= " (calldate regexp '" . $tok . "'
…	…
570	573	)";
571	574	$tok = strtok(" \n\t");
	575	$tok = $dbh->escapeSimple($tok);
572	576	if ($tok) {
573	577	$searchText .= " AND";