Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

FIX security vulnerability reported by ADLab of Venustech

Browse Source
This commit is contained in:
Laurent Destailleur
2017-12-21 12:47:49 +01:00
parent 3f6b3b51ca
commit 4a5988accb
10 changed files with 68 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
htdocs/main.inc.php
View File

@@ -81,7 +81,8 @@ function test_sql_and_script_inject($val, $type)
// For SQL Injection (only GET and POST are used to be included into bad escaped SQL requests)
if ($type != 2)
{
$inj += preg_match('/delete\s+from/i', $val);
$inj += preg_match('/updatexml^(/i', $val);
$inj += preg_match('/delete\s+from/i', $val);
$inj += preg_match('/create\s+table/i', $val);
$inj += preg_match('/update.+set.+=/i', $val);
$inj += preg_match('/insert\s+into/i', $val);