Skip to content

Commit 7c1a5f1

Browse files
dariusstefanrazvancrainea
dariusstefan
authored and
razvancrainea
committed
Check the value of $_GET['table'] against available tables
1 parent 41d1e81 commit 7c1a5f1

4 files changed

Lines changed: 113 additions & 100 deletions

File tree

‎web/tools/users/alias_management/alias_management.php‎

Lines changed: 58 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,10 @@
3232
foreach (get_settings_value("table_aliases") as $key=>$value) {
3333
$options[]=array("label"=>$key,"value"=>$value);
3434
}
35+
$allowed_alias_tables = array();
36+
for ($i = 0; $i < count($options); $i++) {
37+
$allowed_alias_tables[] = $options[$i]['value'];
38+
}
3539

3640
$implicit_domain = get_settings_value("implicit_domain");
3741

@@ -115,15 +119,21 @@
115119
#################
116120
if ($action=="edit")
117121
{
118-
119-
if(!$_SESSION['read_only']){
120-
121-
require("template/".$page_id.".edit.php");
122-
require("template/footer.php");
123-
exit();
124-
}else{
125-
$errors= "User with Read-Only Rights";
126-
}
122+
if(!$_SESSION['read_only']){
123+
$user_table = isset($_GET['table']) ? $_GET['table'] : NULL;
124+
if ($suppress_alias_type) {
125+
$user_table = $options[0]['value'];
126+
}
127+
if ($user_table === NULL || !in_array($user_table, $allowed_alias_tables, true)) {
128+
$errors = "Invalid alias table";
129+
} else {
130+
require("template/".$page_id.".edit.php");
131+
require("template/footer.php");
132+
exit();
133+
}
134+
} else {
135+
$errors= "User with Read-Only Rights";
136+
}
127137
}
128138
#############
129139
# end edit #
@@ -136,52 +146,50 @@
136146
if ($action=="modify")
137147
{
138148

139-
$info="";
140-
$errors="";
149+
$info="";
150+
$errors="";
141151

142-
if(!$_SESSION['read_only']){
143-
144-
$id = $_GET['id'];
145-
$user_table = $_GET['table'];
146-
$alias_username=$_POST['alias_username'];
147-
$alias_domain=$_POST['alias_domain'];
148-
$username = $_POST['username'];
149-
$domain= $_POST['domain'];
152+
if(!$_SESSION['read_only']){
153+
$id = $_GET['id'];
154+
$user_table = isset($_GET['table']) ? $_GET['table'] : NULL;
155+
$alias_username=$_POST['alias_username'];
156+
$alias_domain=$_POST['alias_domain'];
157+
$username = $_POST['username'];
158+
$domain= $_POST['domain'];
150159

151-
if ($suppress_alias_type) {
152-
$user_table = $options[0]['value'];
153-
}
160+
if ($suppress_alias_type) {
161+
$user_table = $options[0]['value'];
162+
}
154163

155-
if ($alias_username=="" || $alias_domain=="" || $username=="" || $domain=="") {
156-
$errors = "Invalid data, the entry was not modified in the database";
157-
} else {
164+
if ($user_table === NULL || !in_array($user_table, $allowed_alias_tables, true)) {
165+
$errors = "Invalid alias table";
166+
} else if ($alias_username=="" || $alias_domain=="" || $username=="" || $domain=="") {
167+
$errors = "Invalid data, the entry was not modified in the database";
168+
} else {
158169
$sql = "SELECT count(*) FROM ".$user_table." WHERE alias_username=? AND alias_domain=? AND id!=?";
159170
$stm = $link->prepare($sql);
160171
if ($stm === FALSE)
161172
die('Failed to issue query, error message : ' . print_r($link->errorInfo(), true));
162173
$stm->execute(array($alias_username, $alias_domain, $id));
163-
174+
164175
if ($stm->fetchColumn(0)>0) {
165176
$errors = "Alias already exists!";
166177
} else {
167-
168-
$sql = "UPDATE ".$user_table." SET alias_username=?, alias_domain=?, username=?, domain=? WHERE id=?";
178+
$sql = "UPDATE ".$user_table." SET alias_username=?, alias_domain=?, username=?, domain=? WHERE id=?";
169179
$stm = $link->prepare($sql);
170180
if ($stm === false) {
171181
die('Failed to issue query ['.$sql.'], error message : ' . print_r($link->errorInfo(), true));
172182
}
173183
if ($stm->execute(array($alias_username, $alias_domain, $username, $domain, $id)) == false) {
174184
$errors= "Updating record in DB failed: ".print_r($stm->errorInfo(), true);
175185
} else {
176-
$info="The alias was modified";
186+
$info="The alias was modified";
177187
}
178188
}
179-
}
180-
}else{
181-
182-
$errors= "User with Read-Only Rights";
183-
}
184-
189+
}
190+
} else {
191+
$errors= "User with Read-Only Rights";
192+
}
185193
}
186194
#################
187195
# end modify #
@@ -249,21 +257,23 @@
249257
################
250258
if ($action=="delete")
251259
{
252-
if(!$_SESSION['read_only']){
253-
254-
$id=$_GET['id'];
255-
$table=$_GET['table'];
260+
if(!$_SESSION['read_only']){
261+
$id=$_GET['id'];
262+
$table = isset($_GET['table']) ? $_GET['table'] : NULL;
263+
if ($table === NULL || !in_array($table, $allowed_alias_tables, true)) {
264+
$errors = "Invalid alias table";
265+
} else {
256266

257-
$sql = "DELETE FROM ".$table." WHERE id=?";
258-
$stm = $link->prepare($sql);
259-
if ($stm===FALSE) {
260-
die('Failed to issue query ['.$sql.'], error message : ' . print_r($link->errorInfo(), true));
267+
$sql = "DELETE FROM ".$table." WHERE id=?";
268+
$stm = $link->prepare($sql);
269+
if ($stm===FALSE) {
270+
die('Failed to issue query ['.$sql.'], error message : ' . print_r($link->errorInfo(), true));
271+
}
272+
$stm->execute( array($id) );
261273
}
262-
$stm->execute( array($id) );
263-
}else{
264-
265-
$errors= "User with Read-Only Rights";
266-
}
274+
} else {
275+
$errors= "User with Read-Only Rights";
276+
}
267277
}
268278
##############
269279
# end delete #

‎web/tools/users/alias_management/template/alias_management.edit.php‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,8 @@
2626
echo(' </tr>');
2727
}
2828
$id=$_GET['id'];
29-
30-
$sql = "select * from ".$_GET['table']." where id=?";
29+
30+
$sql = "select * from ".$user_table." where id=?";
3131
$stm = $link->prepare($sql);
3232
if ($stm === false) {
3333
die('Failed to issue query ['.$sql.'], error message : ' . print_r($link->errorInfo(), true));
@@ -39,7 +39,7 @@
3939
$index_row=0;
4040
?>
4141

42-
<form action="<?=$page_name?>?action=modify&id=<?=$_GET['id']?>&table=<?=$_GET['table']?>" method="post">
42+
<form action="<?=$page_name?>?action=modify&id=<?=$_GET['id']?>&table=<?=urlencode($user_table)?>" method="post">
4343
<?php csrfguard_generate(); ?>
4444
<table width="400" cellspacing="2" cellpadding="2" border="0">
4545
<tr align="center">
@@ -68,4 +68,3 @@
6868

6969
</table>
7070
</form>
71-

‎web/tools/users/group_management/group_management.php‎

Lines changed: 51 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -105,14 +105,19 @@
105105
#################
106106
if ($action=="edit")
107107
{
108-
109-
if(!$_SESSION['read_only']){
110-
require("template/".$page_id.".edit.php");
111-
require("template/footer.php");
112-
exit();
113-
}else{
114-
$errors= "User with Read-Only Rights";
115-
}
108+
if(!$_SESSION['read_only']){
109+
$requested_table = isset($_GET['table']) ? $_GET['table'] : $table;
110+
if ($requested_table !== $table) {
111+
$errors = "Invalid group table";
112+
} else {
113+
$table = $requested_table;
114+
require("template/".$page_id.".edit.php");
115+
require("template/footer.php");
116+
exit();
117+
}
118+
} else {
119+
$errors= "User with Read-Only Rights";
120+
}
116121
}
117122
#############
118123
# end edit #
@@ -124,21 +129,21 @@
124129
#################
125130
if ($action=="modify")
126131
{
127-
128-
$info="";
129-
$errors="";
130-
131-
if(!$_SESSION['read_only']){
132-
133-
$id = $_GET['id'];
134-
$group_username=$_POST['username'];
135-
$group_domain=$_POST['domain'];
136-
$group_grp = $_POST['group'];
137-
138-
if ($group_username=="" || $group_domain=="" || $group_grp==""){
139-
$errors = "Invalid data, the entry was not modified in the database";
140-
} else {
141-
132+
$info="";
133+
$errors="";
134+
135+
if(!$_SESSION['read_only']){
136+
$id = $_GET['id'];
137+
$requested_table = isset($_GET['table']) ? $_GET['table'] : $table;
138+
$group_username=$_POST['username'];
139+
$group_domain=$_POST['domain'];
140+
$group_grp = $_POST['group'];
141+
142+
if ($requested_table !== $table) {
143+
$errors = "Invalid group table";
144+
} else if ($group_username=="" || $group_domain=="" || $group_grp==""){
145+
$errors = "Invalid data, the entry was not modified in the database";
146+
} else {
142147
$sql = "select count(*) from subscriber where username=? and domain=?";
143148
$stm = $link->prepare($sql);
144149
if ($stm === false) {
@@ -148,8 +153,7 @@
148153
if ($stm->fetchColumn(0)<1) {
149154
$errors="This user does not exist !!!";
150155
} else {
151-
152-
$sql = "SELECT * FROM ".$table." WHERE username=? AND domain=? AND grp=? AND id!=?";
156+
$sql = "SELECT * FROM ".$table." WHERE username=? AND domain=? AND grp=? AND id!=?";
153157
$stm = $link->prepare($sql);
154158
if ($stm === false) {
155159
die('Failed to issue query ['.$sql.'], error message : ' . print_r($link->errorInfo(), true));
@@ -161,22 +165,21 @@
161165
}
162166
}
163167

164-
if ($errors=="") {
165-
$sql = "UPDATE ".$table." SET username=?, domain=?, grp=? WHERE id=?";
168+
if ($errors=="") {
169+
$sql = "UPDATE ".$table." SET username=?, domain=?, grp=? WHERE id=?";
166170
$stm = $link->prepare($sql);
167171
if ($stm === false) {
168172
die('Failed to issue query ['.$sql.'], error message : ' . print_r($link->errorInfo(), true));
169173
}
170174
if ($stm->execute( array($group_username, $group_domain, $group_grp, $id) ) == false) {
171175
$errors= "Updating record in DB failed: ".print_r($stm->errorInfo(), true);
172176
} else {
173-
$info="The Group was modified";
177+
$info="The Group was modified";
174178
}
175-
}
176-
}else{
177-
$errors= "User with Read-Only Rights";
178-
}
179-
179+
}
180+
} else {
181+
$errors= "User with Read-Only Rights";
182+
}
180183
}
181184
#################
182185
# end modify #
@@ -260,19 +263,21 @@
260263
if ($action=="delete")
261264
{
262265
if(!$_SESSION['read_only']){
263-
264-
$id=$_GET['id'];
265-
$table=$_GET['table'];
266-
267-
$sql = "DELETE FROM ".$table." WHERE id=?";
268-
$stm = $link->prepare($sql);
269-
if ($stm === false) {
270-
die('Failed to issue query ['.$sql.'], error message : ' . print_r($link->errorInfo(), true));
271-
}
272-
$stm->execute( array($id) );
273-
}else{
274-
275-
$errors= "User with Read-Only Rights";
266+
$id=$_GET['id'];
267+
$requested_table = isset($_GET['table']) ? $_GET['table'] : NULL;
268+
if ($requested_table !== $table) {
269+
$errors = "Invalid group table";
270+
} else {
271+
$table = $requested_table;
272+
$sql = "DELETE FROM ".$table." WHERE id=?";
273+
$stm = $link->prepare($sql);
274+
if ($stm === false) {
275+
die('Failed to issue query ['.$sql.'], error message : ' . print_r($link->errorInfo(), true));
276+
}
277+
$stm->execute( array($id) );
278+
}
279+
} else {
280+
$errors= "User with Read-Only Rights";
276281
}
277282
}
278283
##############

‎web/tools/users/group_management/template/group_management.edit.php‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@
4141
$index_row=0;
4242
?>
4343

44-
<form action="<?=$page_name?>?action=modify&id=<?=$_GET['id']?>&table=<?=$_GET['table']?>" method="post">
44+
<form action="<?=$page_name?>?action=modify&id=<?=$_GET['id']?>&table=<?=urlencode($table)?>" method="post">
4545
<?php csrfguard_generate(); ?>
4646
<table width="400" cellspacing="2" cellpadding="2" border="0">
4747
<table width="400" cellspacing="2" cellpadding="2" border="0">
@@ -70,4 +70,3 @@
7070

7171
</table>
7272
</form>
73-

0 commit comments

Comments
 (0)