AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-15 12:05:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Neutralize CSV formula injection in generated exports using the new created escapeCsvFormula Function

Browse Source
This commit is contained in:
johnnyq
2026-07-24 18:12:45 -04:00
parent 28f1a965b8
commit 5c4805b822
21 changed files with 48 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
agent/post/recurring_invoice.php
View File

@@ -639,7 +639,7 @@ if (isset($_POST['export_client_recurring_invoice_csv'])) {
//output each row of the data, format line as csv and write to file pointer
while($row = $sql->fetch_assoc()) {
$lineData = array($row['recurring_invoice_prefix'] . $row['recurring_invoice_number'], $row['recurring_invoice_scope'], $row['recurring_invoice_amount'], ucwords($row['recurring_invoice_frequency'] . "ly"), $row['recurring_invoice_created_at']);
fputcsv($f, $lineData, $delimiter);
fputcsv($f, array_map('escapeCsvFormula', $lineData), $delimiter);
}
//move back to beginning of file