AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-16 12:35:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Function sanitizeInput() with just escapeSql() and update all instances throughout

Browse Source
This commit is contained in:
johnnyq
2026-07-14 17:17:50 -04:00
parent 7bc47a58fe
commit b57ddc0e5c
148 changed files with 1945 additions and 1945 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
guest/guest_view_item.php
View File

@@ -45,7 +45,7 @@ if (!isset($_GET['id']) || !isset($_GET['key'])) {
}
$item_id = intval($_GET['id']);
$item_key = sanitizeInput($_GET['key']);
$item_key = escapeSql($_GET['key']);
$sql = mysqli_query($mysqli, "SELECT * FROM shared_items WHERE item_id = $item_id AND item_key = '$item_key' AND item_expire_at > NOW() LIMIT 1");
$row = mysqli_fetch_assoc($sql);
@@ -80,8 +80,8 @@ $item_expire = date('Y-m-d h:i A', strtotime($row['item_expire_at']));
$client_id = intval($row['item_client_id']);
// Create in-app notification
$item_type_sql_escaped = sanitizeInput($row['item_type']);
$item_recipient_sql_escaped = sanitizeInput($row['item_recipient']);
$item_type_sql_escaped = escapeSql($row['item_type']);
$item_recipient_sql_escaped = escapeSql($row['item_recipient']);
appNotify("Share Viewed", "$item_type_sql_escaped has been viewed by $item_recipient_sql_escaped", "/agent/client_overview.php?client_id=$client_id", $client_id);
@@ -129,7 +129,7 @@ if ($item_type == "Document") {
}
$doc_title = escapeHtml($doc_row['document_name']);
$doc_title_escaped = sanitizeInput($doc_row['document_name']);
$doc_title_escaped = escapeSql($doc_row['document_name']);
$doc_content = $purifier->purify($doc_row['document_content']);
echo "<h3>$doc_title</h3>";
@@ -256,7 +256,7 @@ if ($item_type == "Document") {
mysqli_query($mysqli, "UPDATE shared_items SET item_views = $new_item_views WHERE item_id = $item_id");
// Logging
$name = sanitizeInput($credential_row['credential_name']);
$name = escapeSql($credential_row['credential_name']);
logAction("Share", "View", "Viewed shared $item_type $name via link", $client_id);
}