AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-23 17:00:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Function sanitizeInput() with just escapeSql() and update all instances throughout

Browse Source
This commit is contained in:
johnnyq
2026-07-14 17:17:50 -04:00
parent 7bc47a58fe
commit b57ddc0e5c
148 changed files with 1945 additions and 1945 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
api/v1/assets/asset_model.php
View File

@@ -2,7 +2,7 @@
// Variable assignment from POST (or: blank/from DB is updating)
if (isset($_POST['asset_name'])) {
$name = sanitizeInput($_POST['asset_name']);
$name = escapeSql($_POST['asset_name']);
} elseif (isset($asset_row) && isset($asset_row['asset_name'])) {
$name = mysqli_real_escape_string($mysqli, $asset_row['asset_name']);
} else {
@@ -10,7 +10,7 @@ if (isset($_POST['asset_name'])) {
}
if (isset($_POST['asset_description'])) {
$description = sanitizeInput($_POST['asset_description']);
$description = escapeSql($_POST['asset_description']);
} elseif (isset($asset_row) && isset($asset_row['asset_description'])) {
$description = mysqli_real_escape_string($mysqli, $asset_row['asset_description']);
} else {
@@ -18,7 +18,7 @@ if (isset($_POST['asset_description'])) {
}
if (isset($_POST['asset_type'])) {
$type = sanitizeInput($_POST['asset_type']);
$type = escapeSql($_POST['asset_type']);
} elseif (isset($asset_row) && isset($asset_row['asset_type'])) {
$type = mysqli_real_escape_string($mysqli, $asset_row['asset_type']);
} else {
@@ -26,14 +26,14 @@ if (isset($_POST['asset_type'])) {
}
if (isset($_POST['asset_make'])) {
$make = sanitizeInput($_POST['asset_make']);
$make = escapeSql($_POST['asset_make']);
} elseif (isset($asset_row) && isset($asset_row['asset_make'])) {
$make = mysqli_real_escape_string($mysqli, $asset_row['asset_make']);
} else {
$make = '';
}
if (isset($_POST['asset_model'])) {
$model = sanitizeInput($_POST['asset_model']);
$model = escapeSql($_POST['asset_model']);
} elseif (isset($asset_row) && isset($asset_row['asset_model'])) {
$model = mysqli_real_escape_string($mysqli, $asset_row['asset_model']);
} else {
@@ -41,7 +41,7 @@ if (isset($_POST['asset_model'])) {
}
if (isset($_POST['asset_serial'])) {
$serial = sanitizeInput($_POST['asset_serial']);
$serial = escapeSql($_POST['asset_serial']);
} elseif (isset($asset_row) && isset($asset_row['asset_serial'])) {
$serial = mysqli_real_escape_string($mysqli, $asset_row['asset_serial']);
} else {
@@ -49,7 +49,7 @@ if (isset($_POST['asset_serial'])) {
}
if (isset($_POST['asset_os'])) {
$os = sanitizeInput($_POST['asset_os']);
$os = escapeSql($_POST['asset_os']);
} elseif (isset($asset_row) && isset($asset_row['asset_os'])) {
$os = mysqli_real_escape_string($mysqli, $asset_row['asset_os']);
} else {
@@ -57,7 +57,7 @@ if (isset($_POST['asset_os'])) {
}
if (isset($_POST['asset_ip'])) {
$ip = sanitizeInput($_POST['asset_ip']);
$ip = escapeSql($_POST['asset_ip']);
} elseif (isset($asset_row) && isset($asset_row['interface_ip'])) {
$ip = mysqli_real_escape_string($mysqli, $asset_row['interface_ip']);
} else {
@@ -65,7 +65,7 @@ if (isset($_POST['asset_ip'])) {
}
if (isset($_POST['asset_mac'])) {
$mac = sanitizeInput($_POST['asset_mac']);
$mac = escapeSql($_POST['asset_mac']);
} elseif (isset($asset_row) && isset($asset_row['interface_mac'])) {
$mac = mysqli_real_escape_string($mysqli, $asset_row['interface_mac']);
} else {
@@ -73,7 +73,7 @@ if (isset($_POST['asset_mac'])) {
}
if (isset($_POST['asset_uri'])) {
$uri = sanitizeInput($_POST['asset_uri']);
$uri = escapeSql($_POST['asset_uri']);
} elseif (isset($asset_row) && isset($asset_row['asset_uri'])) {
$uri = mysqli_real_escape_string($mysqli, $asset_row['asset_uri']);
} else {
@@ -81,7 +81,7 @@ if (isset($_POST['asset_uri'])) {
}
if (isset($_POST['asset_uri_2'])) {
$uri_2 = sanitizeInput($_POST['asset_uri_2']);
$uri_2 = escapeSql($_POST['asset_uri_2']);
} elseif (isset($asset_row) && isset($asset_row['asset_uri_2'])) {
$uri_2 = mysqli_real_escape_string($mysqli, $asset_row['asset_uri_2']);
} else {
@@ -89,7 +89,7 @@ if (isset($_POST['asset_uri_2'])) {
}
if (isset($_POST['asset_status'])) {
$status = sanitizeInput($_POST['asset_status']);
$status = escapeSql($_POST['asset_status']);
} elseif (isset($asset_row) && isset($asset_row['asset_status'])) {
$status = mysqli_real_escape_string($mysqli, $asset_row['asset_status']);
} else {
@@ -97,7 +97,7 @@ if (isset($_POST['asset_status'])) {
}
if (isset($_POST['asset_purchase_date']) && !empty($_POST['asset_purchase_date'])) {
$purchase_date = "'" . sanitizeInput($_POST['asset_purchase_date']) . "'";
$purchase_date = "'" . escapeSql($_POST['asset_purchase_date']) . "'";
} elseif (isset($asset_row) && isset($asset_row['asset_purchase_date'])) {
$purchase_date = "'" . mysqli_real_escape_string($mysqli, $asset_row['asset_purchase_date']) . "'";
} else {
@@ -105,7 +105,7 @@ if (isset($_POST['asset_purchase_date']) && !empty($_POST['asset_purchase_date']
}
if (isset($_POST['asset_warranty_expire']) && !empty($_POST['asset_warranty_expire'])) {
$warranty_expire = "'" . sanitizeInput($_POST['asset_warranty_expire']) . "'";
$warranty_expire = "'" . escapeSql($_POST['asset_warranty_expire']) . "'";
} elseif (isset($asset_row) && isset($asset_row['asset_warranty_expire'])) {
$warranty_expire = "'" . mysqli_real_escape_string($mysqli, $asset_row['asset_warranty_expire']) . "'";
} else {
@@ -113,7 +113,7 @@ if (isset($_POST['asset_warranty_expire']) && !empty($_POST['asset_warranty_expi
}
if (isset($_POST['asset_install_date']) && !empty($_POST['asset_install_date'])) {
$install_date = "'" . sanitizeInput($_POST['asset_install_date']) . "'";
$install_date = "'" . escapeSql($_POST['asset_install_date']) . "'";
} elseif (isset($asset_row) && isset($asset_row['asset_install_date'])) {
$install_date = "'" . mysqli_real_escape_string($mysqli, $asset_row['asset_install_date']) . "'";
} else {
@@ -121,7 +121,7 @@ if (isset($_POST['asset_install_date']) && !empty($_POST['asset_install_date']))
}
if (isset($_POST['asset_notes'])) {
$notes = sanitizeInput($_POST['asset_notes']);
$notes = escapeSql($_POST['asset_notes']);
} elseif (isset($asset_row) && isset($asset_row['asset_notes'])) {
$notes = mysqli_real_escape_string($mysqli, $asset_row['asset_notes']);
} else {

14
api/v1/certificates/certificate_model.php
View File

@@ -3,7 +3,7 @@
// Variable assignment from POST (or: blank/from DB is updating)
if (isset($_POST['certificate_name'])) {
$name = sanitizeInput($_POST['certificate_name']);
$name = escapeSql($_POST['certificate_name']);
} elseif ($certificate_row) {
$name = $certificate_row['certificate_name'];
} else {
@@ -11,7 +11,7 @@ if (isset($_POST['certificate_name'])) {
}
if (isset($_POST['certificate_description'])) {
$description = sanitizeInput($_POST['certificate_description']);
$description = escapeSql($_POST['certificate_description']);
} elseif ($certificate_row) {
$description = $certificate_row['certificate_description'];
} else {
@@ -19,7 +19,7 @@ if (isset($_POST['certificate_description'])) {
}
if (isset($_POST['certificate_domain'])) {
$domain = sanitizeInput($_POST['certificate_domain']);
$domain = escapeSql($_POST['certificate_domain']);
} elseif ($certificate_row) {
$domain = $certificate_row['certificate_domain'];
} else {
@@ -27,7 +27,7 @@ if (isset($_POST['certificate_domain'])) {
}
if (isset($_POST['certificate_issued_by'])) {
$issued_by = sanitizeInput($_POST['certificate_issued_by']);
$issued_by = escapeSql($_POST['certificate_issued_by']);
} elseif ($certificate_row) {
$issued_by = $certificate_row['certificate_issued_by'];
} else {
@@ -35,7 +35,7 @@ if (isset($_POST['certificate_issued_by'])) {
}
if (isset($_POST['certificate_expire'])) {
$expire = sanitizeInput($_POST['certificate_expire']);
$expire = escapeSql($_POST['certificate_expire']);
} elseif ($certificate_row) {
$expire = $certificate_row['certificate_expire'];
} else {
@@ -43,7 +43,7 @@ if (isset($_POST['certificate_expire'])) {
}
if (isset($_POST['certificate_public_key'])) {
$public_key = sanitizeInput($_POST['certificate_public_key']);
$public_key = escapeSql($_POST['certificate_public_key']);
} elseif ($certificate_row) {
$public_key = $certificate_row['certificate_public_key'];
} else {
@@ -51,7 +51,7 @@ if (isset($_POST['certificate_public_key'])) {
}
if (isset($_POST['certificate_notes'])) {
$notes = sanitizeInput($_POST['certificate_notes']);
$notes = escapeSql($_POST['certificate_notes']);
} elseif ($certificate_row) {
$notes = $certificate_row['certificate_notes'];
} else {

2
api/v1/certificates/create.php
View File

@@ -19,7 +19,7 @@ if (!empty($name) && !empty($domain) && !empty($client_id)) {
$public_key_obj = openssl_x509_parse($_POST['certificate_public_key']);
if ($public_key_obj) {
$expire = date('Y-m-d', $public_key_obj['validTo_time_t']);
$issued_by = sanitizeInput($public_key_obj['issuer']['O']);
$issued_by = escapeSql($public_key_obj['issuer']['O']);
}
}

2
api/v1/clients/archive.php
View File

@@ -18,7 +18,7 @@ if (!empty($client_id)) {
if ($row) {
$client_name = sanitizeInput($row['client_name']);
$client_name = escapeSql($row['client_name']);
// Stop recurring invoices
$sql_recurring_invoices = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_client_id = $client_id AND recurring_invoice_status = 1");

16
api/v1/clients/client_model.php
View File

@@ -3,7 +3,7 @@
// Variable assignment from POST (or: blank/from DB is updating)
if (isset($_POST['client_name'])) {
$name = sanitizeInput($_POST['client_name']);
$name = escapeSql($_POST['client_name']);
} elseif ($client_row) {
$name = mysqli_real_escape_string($mysqli, $client_row['client_name']);
} else {
@@ -11,7 +11,7 @@ if (isset($_POST['client_name'])) {
}
if (isset($_POST['client_type'])) {
$type = sanitizeInput($_POST['client_type']);
$type = escapeSql($_POST['client_type']);
} elseif ($client_row) {
$type = mysqli_real_escape_string($mysqli, $client_row['client_type']);
} else {
@@ -19,7 +19,7 @@ if (isset($_POST['client_type'])) {
}
if (isset($_POST['client_website'])) {
$website = preg_replace("(^https?://)", "", sanitizeInput($_POST['client_website']));
$website = preg_replace("(^https?://)", "", escapeSql($_POST['client_website']));
} elseif ($client_row) {
$website = mysqli_real_escape_string($mysqli, $client_row['client_website']);
} else {
@@ -27,7 +27,7 @@ if (isset($_POST['client_website'])) {
}
if (isset($_POST['client_referral'])) {
$referral = sanitizeInput($_POST['client_referral']);
$referral = escapeSql($_POST['client_referral']);
} elseif ($client_row) {
$referral = mysqli_real_escape_string($mysqli, $client_row['client_referral']);
} else {
@@ -43,7 +43,7 @@ if (isset($_POST['client_rate'])) {
}
if (isset($_POST['client_currency_code'])) {
$currency_code = sanitizeInput($_POST['client_currency_code']);
$currency_code = escapeSql($_POST['client_currency_code']);
} elseif ($client_row) {
$currency_code = mysqli_real_escape_string($mysqli, $client_row['client_currency_code']);
} else {
@@ -59,7 +59,7 @@ if (isset($_POST['client_net_terms'])) {
}
if (isset($_POST['client_tax_id_number'])) {
$tax_id_number = sanitizeInput($_POST['client_tax_id_number']);
$tax_id_number = escapeSql($_POST['client_tax_id_number']);
} elseif ($client_row) {
$tax_id_number = mysqli_real_escape_string($mysqli, $client_row['client_tax_id_number']);
} else {
@@ -67,7 +67,7 @@ if (isset($_POST['client_tax_id_number'])) {
}
if (isset($_POST['client_abbreviation'])) {
$abbreviation = sanitizeInput(substr($_POST['client_abbreviation'], 0, 6));
$abbreviation = escapeSql(substr($_POST['client_abbreviation'], 0, 6));
} elseif ($client_row) {
$abbreviation = mysqli_real_escape_string($mysqli, $client_row['client_abbreviation']);
} else {
@@ -83,7 +83,7 @@ if (isset($_POST['client_is_lead'])) {
}
if (isset($_POST['client_notes'])) {
$notes = sanitizeInput($_POST['client_notes']);
$notes = escapeSql($_POST['client_notes']);
} elseif ($client_row) {
$notes = mysqli_real_escape_string($mysqli, $client_row['client_notes']);
} else {

2
api/v1/clients/unarchive.php
View File

@@ -18,7 +18,7 @@ if (!empty($client_id)) {
if ($row) {
$client_name = sanitizeInput($row['client_name']);
$client_name = escapeSql($row['client_name']);
// Un-archive client
$update_sql = mysqli_query($mysqli, "UPDATE clients SET client_archived_at = NULL WHERE client_id = $client_id");

2
api/v1/contacts/archive.php
View File

@@ -21,7 +21,7 @@ if (!empty($contact_id)) {
if ($row) {
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_user_id = intval($row['contact_user_id']);
// Archive associated user if applicable

10
api/v1/contacts/contact_model.php
View File

@@ -3,7 +3,7 @@ define('number_regex', '/[^0-9]/');
// Variable assignment from POST (or: blank/from DB is updating)
if (isset($_POST['contact_name'])) {
$name = sanitizeInput($_POST['contact_name']);
$name = escapeSql($_POST['contact_name']);
} elseif ($contact_row) {
$name = mysqli_real_escape_string($mysqli, $contact_row['contact_name']);
} else {
@@ -11,7 +11,7 @@ if (isset($_POST['contact_name'])) {
}
if (isset($_POST['contact_title'])) {
$title = sanitizeInput($_POST['contact_title']);
$title = escapeSql($_POST['contact_title']);
} elseif ($contact_row) {
$title = mysqli_real_escape_string($mysqli, $contact_row['contact_title']);
} else {
@@ -19,7 +19,7 @@ if (isset($_POST['contact_title'])) {
}
if (isset($_POST['contact_department'])) {
$department = sanitizeInput($_POST['contact_department']);
$department = escapeSql($_POST['contact_department']);
} elseif ($contact_row) {
$department = mysqli_real_escape_string($mysqli, $contact_row['contact_department']);
} else {
@@ -27,7 +27,7 @@ if (isset($_POST['contact_department'])) {
}
if (isset($_POST['contact_email'])) {
$email = sanitizeInput($_POST['contact_email']);
$email = escapeSql($_POST['contact_email']);
} elseif ($contact_row) {
$email = mysqli_real_escape_string($mysqli, $contact_row['contact_email']);
} else {
@@ -59,7 +59,7 @@ if (isset($_POST['contact_mobile'])) {
}
if (isset($_POST['contact_notes'])) {
$notes = sanitizeInput($_POST['contact_notes']);
$notes = escapeSql($_POST['contact_notes']);
} elseif ($contact_row) {
$notes = mysqli_real_escape_string($mysqli, $contact_row['contact_notes']);
} else {

2
api/v1/contacts/unarchive.php
View File

@@ -21,7 +21,7 @@ if (!empty($contact_id)) {
if ($row) {
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_user_id = intval($row['contact_user_id']);
// Un-archive associated user if applicable

12
api/v1/credentials/credential_model.php
View File

@@ -9,7 +9,7 @@ if (isset($_POST['api_key_decrypt_password'])) {
}
if (isset($_POST['credential_name'])) {
$name = sanitizeInput($_POST['credential_name']);
$name = escapeSql($_POST['credential_name']);
} elseif (isset($credential_row) && isset($credential_row['credential_name'])) {
$name = mysqli_real_escape_string($mysqli, $credential_row['credential_name']);
} else {
@@ -17,7 +17,7 @@ if (isset($_POST['credential_name'])) {
}
if (isset($_POST['credential_description'])) {
$description = sanitizeInput($_POST['credential_description']);
$description = escapeSql($_POST['credential_description']);
} elseif (isset($credential_row) && isset($credential_row['credential_description'])) {
$description = mysqli_real_escape_string($mysqli, $credential_row['credential_description']);
} else {
@@ -25,7 +25,7 @@ if (isset($_POST['credential_description'])) {
}
if (isset($_POST['credential_uri'])) {
$uri = sanitizeInput($_POST['credential_uri']);
$uri = escapeSql($_POST['credential_uri']);
} elseif (isset($credential_row) && isset($credential_row['credential_uri'])) {
$uri = mysqli_real_escape_string($mysqli, $credential_row['credential_uri']);
} else {
@@ -33,7 +33,7 @@ if (isset($_POST['credential_uri'])) {
}
if (isset($_POST['credential_uri_2'])) {
$uri_2 = sanitizeInput($_POST['credential_uri_2']);
$uri_2 = escapeSql($_POST['credential_uri_2']);
} elseif (isset($credential_row) && isset($credential_row['credential_uri_2'])) {
$uri_2 = mysqli_real_escape_string($mysqli, $credential_row['credential_uri_2']);
} else {
@@ -62,7 +62,7 @@ if (isset($_POST['credential_password'])) {
}
if (isset($_POST['credential_otp_secret'])) {
$otp_secret = sanitizeInput($_POST['credential_otp_secret']);
$otp_secret = escapeSql($_POST['credential_otp_secret']);
} elseif (isset($credential_row) && isset($credential_row['credential_otp_secret'])) {
$otp_secret = mysqli_real_escape_string($mysqli, $credential_row['credential_otp_secret']);
} else {
@@ -70,7 +70,7 @@ if (isset($_POST['credential_otp_secret'])) {
}
if (isset($_POST['credential_note'])) {
$note = sanitizeInput($_POST['credential_note']);
$note = escapeSql($_POST['credential_note']);
} elseif (isset($credential_row) && isset($credential_row['credential_note'])) {
$note = mysqli_real_escape_string($mysqli, $credential_row['credential_note']);
} else {

6
api/v1/documents/document_model.php
View File

@@ -2,7 +2,7 @@
// Variable assignment from POST (or: blank/from DB is updating)
if (isset($_POST['document_name'])) {
$name = sanitizeInput($_POST['document_name']);
$name = escapeSql($_POST['document_name']);
} elseif (isset($document_row) && isset($document_row['document_name'])) {
$name = mysqli_real_escape_string($mysqli, $document_row['document_name']);
} else {
@@ -10,7 +10,7 @@ if (isset($_POST['document_name'])) {
}
if (isset($_POST['document_description'])) {
$description = sanitizeInput($_POST['document_description']);
$description = escapeSql($_POST['document_description']);
} elseif (isset($document_row) && isset($document_row['document_description'])) {
$description = mysqli_real_escape_string($mysqli, $document_row['document_description']);
} else {
@@ -27,7 +27,7 @@ if (isset($_POST['document_content'])) {
// Raw content (used for FULL INDEX searching)
if (isset($_POST['document_content'])) {
$content_raw = sanitizeInput($_POST['document_name'] . $_POST['document_description'] . " " . str_replace("<", " <", $_POST['document_content']));
$content_raw = escapeSql($_POST['document_name'] . $_POST['document_description'] . " " . str_replace("<", " <", $_POST['document_content']));
} elseif (isset($document_row) && isset($document_row['document_content_raw'])) {
$content_raw = mysqli_real_escape_string($mysqli, $document_row['document_content_raw']);
} else {

10
api/v1/documents/update.php
View File

@@ -25,13 +25,13 @@ if (!empty($document_id)) {
$row = mysqli_fetch_assoc($sql_original_document);
// Pull original fields for versioning
$original_document_name = sanitizeInput($row['document_name']);
$original_document_description = sanitizeInput($row['document_description']);
$original_document_name = escapeSql($row['document_name']);
$original_document_description = escapeSql($row['document_description']);
$original_document_content = mysqli_real_escape_string($mysqli, $row['document_content']);
$original_document_created_by = intval($row['document_created_by']);
$original_document_updated_by = intval($row['document_updated_by']);
$original_document_created_at = sanitizeInput($row['document_created_at']);
$original_document_updated_at = sanitizeInput($row['document_updated_at']);
$original_document_created_at = escapeSql($row['document_created_at']);
$original_document_updated_at = escapeSql($row['document_updated_at']);
// Determine who/when created the version (same logic as app)
if (!empty($original_document_updated_at)) {
@@ -89,7 +89,7 @@ if (!empty($document_id)) {
$content_db = mysqli_real_escape_string($mysqli, $processed_html);
// Rebuild content_raw for full-text search (same technique as app)
$content_raw = sanitizeInput($name . " " . str_replace("<", " <", $processed_html));
$content_raw = escapeSql($name . " " . str_replace("<", " <", $processed_html));
$content_raw = mysqli_real_escape_string($mysqli, $content_raw);
// Escape name/description too (document_model.php may already sanitize; do DB escaping here regardless)

18
api/v1/locations/location_model.php
View File

@@ -3,7 +3,7 @@
// Variable assignment from POST (or: blank/from DB is updating)
if (isset($_POST['location_name'])) {
$name = sanitizeInput($_POST['location_name']);
$name = escapeSql($_POST['location_name']);
} elseif ($location_row) {
$name = mysqli_real_escape_string($mysqli, $location_row['location_name']);
} else {
@@ -11,7 +11,7 @@ if (isset($_POST['location_name'])) {
}
if (isset($_POST['location_description'])) {
$description = sanitizeInput($_POST['location_description']);
$description = escapeSql($_POST['location_description']);
} elseif ($location_row) {
$description = mysqli_real_escape_string($mysqli, $location_row['location_description']);
} else {
@@ -19,7 +19,7 @@ if (isset($_POST['location_description'])) {
}
if (isset($_POST['location_country'])) {
$country = sanitizeInput($_POST['location_country']);
$country = escapeSql($_POST['location_country']);
} elseif ($location_row) {
$country = mysqli_real_escape_string($mysqli, $location_row['location_country']);
} else {
@@ -27,7 +27,7 @@ if (isset($_POST['location_country'])) {
}
if (isset($_POST['location_address'])) {
$address = sanitizeInput($_POST['location_address']);
$address = escapeSql($_POST['location_address']);
} elseif ($location_row) {
$address = mysqli_real_escape_string($mysqli, $location_row['location_address']);
} else {
@@ -35,7 +35,7 @@ if (isset($_POST['location_address'])) {
}
if (isset($_POST['location_city'])) {
$city = sanitizeInput($_POST['location_city']);
$city = escapeSql($_POST['location_city']);
} elseif ($location_row) {
$city = mysqli_real_escape_string($mysqli, $location_row['location_city']);
} else {
@@ -43,7 +43,7 @@ if (isset($_POST['location_city'])) {
}
if (isset($_POST['location_state'])) {
$state = sanitizeInput($_POST['location_state']);
$state = escapeSql($_POST['location_state']);
} elseif ($location_row) {
$state = mysqli_real_escape_string($mysqli, $location_row['location_state']);
} else {
@@ -51,7 +51,7 @@ if (isset($_POST['location_state'])) {
}
if (isset($_POST['location_zip'])) {
$zip = sanitizeInput($_POST['location_zip']);
$zip = escapeSql($_POST['location_zip']);
} elseif ($location_row) {
$zip = mysqli_real_escape_string($mysqli, $location_row['location_zip']);
} else {
@@ -59,7 +59,7 @@ if (isset($_POST['location_zip'])) {
}
if (isset($_POST['location_hours'])) {
$hours = sanitizeInput($_POST['location_hours']);
$hours = escapeSql($_POST['location_hours']);
} elseif ($location_row) {
$hours = mysqli_real_escape_string($mysqli, $location_row['location_hours']);
} else {
@@ -67,7 +67,7 @@ if (isset($_POST['location_hours'])) {
}
if (isset($_POST['location_notes'])) {
$notes = sanitizeInput($_POST['location_notes']);
$notes = escapeSql($_POST['location_notes']);
} elseif ($location_row) {
$notes = mysqli_real_escape_string($mysqli, $location_row['location_notes']);
} else {

4
api/v1/tickets/resolve.php
View File

@@ -19,9 +19,9 @@ if (!empty($ticket_id)) {
// Grab what we need, not using the model
$ticket_id = intval($ticket_row['ticket_id']); // Override so things fail if this is bad
$ticket_prefix = sanitizeInput($ticket_row['ticket_prefix']);
$ticket_prefix = escapeSql($ticket_row['ticket_prefix']);
$ticket_number = intval($ticket_row['ticket_number']);
$ticket_first_response_at = sanitizeInput($ticket_row['ticket_first_response_at']);
$ticket_first_response_at = escapeSql($ticket_row['ticket_first_response_at']);
// Mark FR (if not)
if (empty($ticket_first_response_at)) {

4
api/v1/tickets/ticket_model.php
View File

@@ -19,7 +19,7 @@ if (isset($_POST['ticket_asset_id'])) {
}
if (isset($_POST['ticket_subject'])) {
$subject = sanitizeInput($_POST['ticket_subject']);
$subject = escapeSql($_POST['ticket_subject']);
} elseif ($ticket_row) {
$subject = mysqli_real_escape_string($mysqli, $ticket_row['ticket_subject']);
} else {
@@ -28,7 +28,7 @@ if (isset($_POST['ticket_subject'])) {
if (isset($_POST['ticket_priority'])) {
$priority = sanitizeInput($_POST['ticket_priority']);
$priority = escapeSql($_POST['ticket_priority']);
} elseif ($ticket_row) {
$priority = mysqli_real_escape_string($mysqli, $ticket_row['ticket_priority']);
} else {

12
api/v1/validate_api_key.php
View File

@@ -17,8 +17,8 @@ header('Content-Type: application/json');
$_POST = json_decode(file_get_contents('php://input'), true);
// Get IP & UA
$ip = sanitizeInput(getIP());
$user_agent = sanitizeInput($_SERVER['HTTP_USER_AGENT']);
$ip = escapeSql(getIP());
$user_agent = escapeSql($_SERVER['HTTP_USER_AGENT']);
// Temp Added this to work with the new logAction function
$session_ip = $ip;
@@ -60,15 +60,15 @@ if (!isset($_GET['api_key']) && !isset($_POST['api_key'])) {
// Set API key variable
if (isset($_GET['api_key'])) {
$api_key = sanitizeInput($_GET['api_key']);
$api_key = escapeSql($_GET['api_key']);
}
if (isset($_POST['api_key'])) {
$api_key = sanitizeInput($_POST['api_key']);
$api_key = escapeSql($_POST['api_key']);
}
// Validate API key
if (isset($api_key)) {
$api_key = sanitizeInput($api_key);
$api_key = escapeSql($api_key);
$sql = mysqli_query($mysqli, "SELECT * FROM api_keys WHERE api_key_secret = '$api_key' AND api_key_expire > NOW() LIMIT 1");
@@ -76,7 +76,7 @@ if (isset($api_key)) {
if (mysqli_num_rows($sql) !== 1) {
// Invalid Key
$url_path = sanitizeInput(parse_url($_SERVER["REQUEST_URI"], PHP_URL_PATH));
$url_path = escapeSql(parse_url($_SERVER["REQUEST_URI"], PHP_URL_PATH));
mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Failed', log_description = 'Incorrect or expired key (endpoint: $url_path)', log_ip = '$ip', log_user_agent = '$user_agent'");
$return_arr['success'] = "False";