AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-16 20:45:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert PAyment cleanInput too

Browse Source
This commit is contained in:
johnnyq
2026-08-01 18:48:07 -04:00
parent 056db263a5
commit c8dab1a7e5
2 changed files with 8 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
admin/post/payment_method.php
View File

@@ -1,7 +1,7 @@
<?php <?php
/* /*
* ITFlow - GET/POST request handler for AI Providers ('ai_providers') * ITFlow - GET/POST request handler for payment methods ('payment_methods')
*/ */
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
@@ -10,17 +10,10 @@ if (isset($_POST['add_payment_method'])) {
validateCSRFToken(); validateCSRFToken();
$name = cleanInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = cleanInput($_POST['description']); $description = escapeSql($_POST['description']);
$query = mysqli_prepare( mysqli_query($mysqli, "INSERT INTO payment_methods SET payment_method_name = '$name', payment_method_description = '$description'");
$mysqli, "INSERT INTO payment_methods
SET payment_method_name = ?, payment_method_description = ?"
);
mysqli_stmt_bind_param($query, "ss", $name, $description);
mysqli_stmt_execute($query);
logAudit("Payment Method", "Create", "$session_name created Payment Method $name"); logAudit("Payment Method", "Create", "$session_name created Payment Method $name");
@@ -35,19 +28,10 @@ if (isset($_POST['edit_payment_method'])) {
validateCSRFToken(); validateCSRFToken();
$payment_method_id = intval($_POST['payment_method_id']); $payment_method_id = intval($_POST['payment_method_id']);
$name = cleanInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = cleanInput($_POST['description']); $description = escapeSql($_POST['description']);
$query = mysqli_prepare( mysqli_query($mysqli, "UPDATE payment_methods SET payment_method_name = '$name', payment_method_description = '$description' WHERE payment_method_id = $payment_method_id");
$mysqli,
"UPDATE payment_methods
SET payment_method_name = ?, payment_method_description = ?
WHERE payment_method_id = ?"
);
mysqli_stmt_bind_param($query, "ssi", $name, $description, $payment_method_id);
mysqli_stmt_execute($query);
logAudit("Payment Method", "Edit", "$session_name edited Payment Method $name"); logAudit("Payment Method", "Edit", "$session_name edited Payment Method $name");
@@ -63,7 +47,7 @@ if (isset($_GET['delete_payment_method'])) {
$payment_method_id = intval($_GET['delete_payment_method']); $payment_method_id = intval($_GET['delete_payment_method']);
$payment_method_name = escapeSql(getFieldById('payment_methods', $payment_method_is, 'payment_method_name')); $payment_method_name = escapeSql(getFieldById('payment_methods', $payment_method_id, 'payment_method_name'));
mysqli_query($mysqli,"DELETE FROM payment_methods WHERE payment_method_id = $payment_method_id"); mysqli_query($mysqli,"DELETE FROM payment_methods WHERE payment_method_id = $payment_method_id");

19
functions/sanitize.php
View File

@@ -32,25 +32,6 @@ function escapeSql($input) {
return $input; return $input;
} }
function cleanInput($input) {
// Only process non-empty input
if (!empty($input)) {
// Normalize encoding to UTF-8 if it’s not valid
if (!mb_check_encoding($input, 'UTF-8')) {
// Convert from Windows-1252 as a safe fallback
$input = mb_convert_encoding($input, 'UTF-8', 'Windows-1252');
}
}
// Remove HTML and PHP tags
$input = strip_tags((string) $input);
// Trim whitespace
$input = trim($input);
return $input;
}
function toAlphanumeric($string) { function toAlphanumeric($string) {
// Gets rid of non-alphanumerics // Gets rid of non-alphanumerics
return preg_replace('/[^A-Za-z0-9_-]/', '', $string); return preg_replace('/[^A-Za-z0-9_-]/', '', $string);