AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-23 08:50:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Function sanitizeInput() with just escapeSql() and update all instances throughout

Browse Source
This commit is contained in:
johnnyq
2026-07-14 17:17:50 -04:00
parent 7bc47a58fe
commit b57ddc0e5c
148 changed files with 1945 additions and 1945 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
agent/post/project.php
View File

@@ -12,9 +12,9 @@ if (isset($_POST['add_project'])) {
enforceUserPermission('module_support', 2);
$project_name = sanitizeInput($_POST['name']);
$project_description = sanitizeInput($_POST['description']);
$due_date = sanitizeInput($_POST['due_date']);
$project_name = escapeSql($_POST['name']);
$project_description = escapeSql($_POST['description']);
$due_date = escapeSql($_POST['due_date']);
$project_manager = intval($_POST['project_manager']);
$client_id = intval($_POST['client_id']);
$project_template_id = intval($_POST['project_template_id']);
@@ -25,7 +25,7 @@ if (isset($_POST['add_project'])) {
}
// Sanitize Project Prefix
$config_project_prefix = sanitizeInput($config_project_prefix);
$config_project_prefix = escapeSql($config_project_prefix);
// Atomically increment and get the new project number
mysqli_query($mysqli, "
@@ -53,7 +53,7 @@ if (isset($_POST['add_project'])) {
while ($row = mysqli_fetch_assoc($sql_ticket_templates)) {
$ticket_template_id = intval($row['ticket_template_id']);
$ticket_template_order = intval($row['ticket_template_order']);
$ticket_template_subject = sanitizeInput($row['ticket_template_subject']);
$ticket_template_subject = escapeSql($row['ticket_template_subject']);
$ticket_template_details = mysqli_escape_string($mysqli, $row['ticket_template_details']);
// Atomically increment and get the new ticket number
@@ -79,7 +79,7 @@ if (isset($_POST['add_project'])) {
while ($row = mysqli_fetch_assoc($sql_task_templates)) {
$task_template_id = intval($row['task_template_id']);
$task_template_order = intval($row['task_template_order']);
$task_template_name = sanitizeInput($row['task_template_name']);
$task_template_name = escapeSql($row['task_template_name']);
mysqli_query($mysqli,"INSERT INTO tasks SET task_name = '$task_template_name', task_order = $task_template_order, task_ticket_id = $ticket_id");
} // End task Loop
@@ -101,9 +101,9 @@ if (isset($_POST['edit_project'])) {
enforceUserPermission('module_support', 2);
$project_id = intval($_POST['project_id']);
$project_name = sanitizeInput($_POST['name']);
$project_description = sanitizeInput($_POST['description']);
$due_date = sanitizeInput($_POST['due_date']);
$project_name = escapeSql($_POST['name']);
$project_description = escapeSql($_POST['description']);
$due_date = escapeSql($_POST['due_date']);
$project_manager = intval($_POST['project_manager']);
$client_id = intval($_POST['client_id']);
@@ -133,7 +133,7 @@ if (isset($_GET['close_project'])) {
// Get Project Name and Client ID for logging
$sql = mysqli_query($mysqli, "SELECT project_name, project_client_id FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql);
$project_name = sanitizeInput($row['project_name']);
$project_name = escapeSql($row['project_name']);
$client_id = intval($row['project_client_id']);
// Don't Enforce Client Access if Project doesn't have an assigned client
@@ -162,7 +162,7 @@ if (isset($_GET['archive_project'])) {
// Get Project Name and Client ID for logging
$sql = mysqli_query($mysqli, "SELECT project_name, project_client_id FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql);
$project_name = sanitizeInput($row['project_name']);
$project_name = escapeSql($row['project_name']);
$client_id = intval($row['project_client_id']);
// Don't Enforce Client Access if Project doesn't have an assigned client
@@ -191,8 +191,8 @@ if (isset($_GET['restore_project'])) {
// Get Project Name and Client ID for logging
$sql = mysqli_query($mysqli, "SELECT project_name, project_client_id FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql);
$project_name = sanitizeInput($row['project_name']);
$client_id = sanitizeInput($row['project_client_id']);
$project_name = escapeSql($row['project_name']);
$client_id = escapeSql($row['project_client_id']);
// Don't Enforce Client Access if Project doesn't have an assigned client
if ($client_id) {
@@ -220,7 +220,7 @@ if (isset($_GET['delete_project'])) {
// Get Project Name and Client ID for logging
$sql = mysqli_query($mysqli, "SELECT project_name, project_client_id FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql);
$project_name = sanitizeInput($row['project_name']);
$project_name = escapeSql($row['project_name']);
$client_id = intval($row['project_client_id']);
// Don't Enforce Client Access if Project doesn't have an assigned client
@@ -250,7 +250,7 @@ if (isset($_POST['link_ticket_to_project'])) {
$sql = mysqli_query($mysqli, "SELECT project_client_id, project_name FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['project_client_id']);
$project_name = sanitizeInput($row['project_name']);
$project_name = escapeSql($row['project_name']);
// Don't Enforce Client Access if Project doesn't have an assigned client
if ($client_id) {
@@ -269,9 +269,9 @@ if (isset($_POST['link_ticket_to_project'])) {
// Get Ticket Info
$sql = mysqli_query($mysqli, "SELECT ticket_prefix, ticket_number, ticket_subject FROM tickets WHERE ticket_id = $ticket_id");
$row = mysqli_fetch_assoc($sql);
$ticket_prefix = sanitizeInput($row['ticket_prefix']);
$ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = sanitizeInput($row['ticket_subject']);
$ticket_subject = escapeSql($row['ticket_subject']);
mysqli_query($mysqli, "UPDATE tickets SET ticket_project_id = $project_id WHERE ticket_id = $ticket_id");
@@ -301,7 +301,7 @@ if (isset($_POST['link_closed_ticket_to_project'])) {
$sql = mysqli_query($mysqli, "SELECT project_client_id, project_name FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['project_client_id']);
$project_name = sanitizeInput($row['project_name']);
$project_name = escapeSql($row['project_name']);
// Don't Enforce Client Access if Project doesn't have an assigned client
if ($client_id) {
@@ -316,10 +316,10 @@ if (isset($_POST['link_closed_ticket_to_project'])) {
}
$row = mysqli_fetch_assoc($sql);
$ticket_id = intval($row['ticket_id']);
$ticket_prefix = sanitizeInput($row['ticket_prefix']);
$ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = sanitizeInput($row['ticket_subject']);
$ticket_updated = sanitizeInput($row['ticket_updated_at']); // So we don't mess with the last response
$ticket_subject = escapeSql($row['ticket_subject']);
$ticket_updated = escapeSql($row['ticket_updated_at']); // So we don't mess with the last response
mysqli_query($mysqli, "UPDATE tickets SET ticket_project_id = $project_id, ticket_updated_at = '$ticket_updated' WHERE ticket_id = $ticket_id");