johnnyq f7cc3fde54 Make the audit log, notification and history writers safe whatever text they are given, and fix the API client delete that relied on them: logAudit, appNotify, logTicketHistory and logHistory now pass their text through the new logSqlText, which reads it as MySQL reads a quoted string, cuts it to the column by character and escapes it once, so text a caller escaped is stored exactly as before and text passed as read from a row can no longer end the quote; api/v1/clients/delete.php escapes the client name as archive.php does, where a name written for the purpose ran a query when the client was deleted and a name with an apostrophe ended in an error after the delete with nothing logged; logAudit also cuts the session IP and User-Agent to their columns, since a User-Agent over 250 characters failed the insert under strict mode, leaving the action unlogged and failed sign-ins and wrong two-step codes uncounted by the lockout and the code limit, and the User-Agent is cut to 250 where it is written to logs directly or compared with it in login.php, client/login_reset.php, api/v1/validate_api_key.php, guest/includes/inc_all_guest.php and portalSignupRequest; add_invoice_copy, add_invoice_recurring and add_recurring_invoice escape the invoice and recurring invoice prefixes before their inserts, which failed with an apostrophe in the prefix; add the changelog entries

2026-11-11 11:57:09 -05:00

36 KiB

Raw Permalink Blame History

View Raw