AS1024
/
itflow
mirror of https://github.com/itflow-org/itflow
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Escape special characters in a shared doc/file/login name to prevent potentially breaking the ajax sharing log query

This commit is contained in:
Marcus Hill 2023-01-02 14:14:30 +00:00
parent b37778b7a1
commit 2454961389
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ajax.php
View File

@ -222,19 +222,19 @@ if (isset($_GET['share_generate_link'])) {
if ($item_type == "Document") {
$row = mysqli_fetch_array(mysqli_query($mysqli, "SELECT document_name FROM documents WHERE document_id = '$item_id' AND document_client_id = '$client_id' LIMIT 1"));
$item_name = $row['document_name'];
$item_name = strip_tags(mysqli_real_escape_string($mysqli, $row['document_name']));
}
if ($item_type == "File") {
$row = mysqli_fetch_array(mysqli_query($mysqli, "SELECT file_name FROM files WHERE file_id = '$item_id' AND file_client_id = '$client_id' LIMIT 1"));
$item_name = $row['file_name'];
$item_name = strip_tags(mysqli_real_escape_string($mysqli, $row['file_name']));
}
if ($item_type == "Login") {
$login = mysqli_query($mysqli, "SELECT login_name, login_password FROM logins WHERE login_id = '$item_id' AND login_client_id = '$client_id' LIMIT 1");
$row = mysqli_fetch_array($login);
$item_name = $row['login_name'];
$item_name = strip_tags(mysqli_real_escape_string($mysqli, $row['login_name']));
// Decrypt & re-encrypt password for sharing
$login_password_cleartext = decryptLoginEntry($row['login_password']);