Changeset 6565

Show
Ignore:
Timestamp:
09/04/08 14:47:28 (3 months ago)
Author:
p_lindheimer
Message:

Merged revisions 6564 via svnmerge from
http://svn.freepbx.org/freepbx/branches/2.4

................

r6564 | p_lindheimer | 2008-09-04 14:45:33 -0700 (Thu, 04 Sep 2008) | 9 lines


Merged revisions 6563 via svnmerge from
http://svn.freepbx.org/freepbx/branches/2.5


........

r6563 | p_lindheimer | 2008-09-04 14:43:50 -0700 (Thu, 04 Sep 2008) | 1 line


fix SECURITY SQL Injection vulnerability that could allow an authenticated user to access CDR and recorded calls from any other user on the system

........

................

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved
  • freepbx/branches/2.3

    • Property svnmerge-integrated changed from /freepbx/branches/2.2:1-4145,4434,4437 /freepbx/branches/2.4:1-5454,5492,5517,5648,5656,5710,5828,6057 to /freepbx/branches/2.2:1-4145,4434,4437 /freepbx/branches/2.4:1-5454,5492,5517,5648,5656,5710,5828,6057,6564
  • freepbx/branches/2.3/amp_conf/htdocs/recordings/modules/callmonitor.module

    r4972 r6565  
    202202 
    203203    // table body 
    204     foreach($data as $key=>$value) { 
     204    if (is_array($data)) foreach($data as $key=>$value) { 
    205205 
    206206      // recording file 
     
    383383    } 
    384384 
    385     foreach($data as $data_key => $data_value) { 
     385    if (is_array($data)) foreach($data as $data_key => $data_value) { 
    386386 
    387387      $recording=''; 
     
    545545    // search text 
    546546    if ($q!='*' && $q!=NULL) { 
     547 
     548      $dbh = $_SESSION['dbh_cdr']; 
    547549      $searchText .= "WHERE "; 
    548550      $tok = strtok($q," \n\t"); 
     551      $tok = $dbh->escapeSimple($tok); 
    549552      while ($tok) { 
    550553        $searchText .= " (calldate regexp '" . $tok . "' 
     
    560563                       )"; 
    561564        $tok = strtok(" \n\t"); 
     565        $tok = $dbh->escapeSimple($tok); 
    562566        if ($tok) { 
    563567          $searchText .= " AND"; 
Donate



Support
Download
Develop
Forums
News
Documentation
Paid Support
About

Paid Ads