Skip to content

Commit a7ce7b9

Browse files
dariusstefanrazvancrainea
dariusstefan
authored and
razvancrainea
committed
Check the value of $_GET['table'] against available tables
1 parent c95e9d6 commit a7ce7b9

4 files changed

Lines changed: 113 additions & 96 deletions

File tree

‎web/tools/users/alias_management/alias_management.php‎

Lines changed: 58 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,10 @@
3232
foreach (get_settings_value("table_aliases") as $key=>$value) {
3333
$options[]=array("label"=>$key,"value"=>$value);
3434
}
35+
$allowed_alias_tables = array();
36+
for ($i = 0; $i < count($options); $i++) {
37+
$allowed_alias_tables[] = $options[$i]['value'];
38+
}
3539

3640
$current_page="current_page_alias_management";
3741

@@ -107,15 +111,21 @@
107111
#################
108112
if ($action=="edit")
109113
{
110-
111-
if(!$_SESSION['read_only']){
112-
113-
require("template/".$page_id.".edit.php");
114-
require("template/footer.php");
115-
exit();
116-
}else{
117-
$errors= "User with Read-Only Rights";
118-
}
114+
if(!$_SESSION['read_only']){
115+
$user_table = isset($_GET['table']) ? $_GET['table'] : NULL;
116+
if ($suppress_alias_type) {
117+
$user_table = $options[0]['value'];
118+
}
119+
if ($user_table === NULL || !in_array($user_table, $allowed_alias_tables, true)) {
120+
$errors = "Invalid alias table";
121+
} else {
122+
require("template/".$page_id.".edit.php");
123+
require("template/footer.php");
124+
exit();
125+
}
126+
} else {
127+
$errors= "User with Read-Only Rights";
128+
}
119129
}
120130
#############
121131
# end edit #
@@ -128,48 +138,50 @@
128138
if ($action=="modify")
129139
{
130140

131-
$info="";
132-
$errors="";
141+
$info="";
142+
$errors="";
133143

134-
if(!$_SESSION['read_only']){
144+
if(!$_SESSION['read_only']){
145+
$id = $_GET['id'];
146+
$user_table = isset($_GET['table']) ? $_GET['table'] : NULL;
147+
$alias_username=$_POST['alias_username'];
148+
$alias_domain=$_POST['alias_domain'];
149+
$username = $_POST['username'];
150+
$domain= $_POST['domain'];
135151

136-
$id = $_GET['id'];
137-
$user_table = $_GET['table'];
138-
$alias_username=$_POST['alias_username'];
139-
$alias_domain=$_POST['alias_domain'];
140-
$username = $_POST['username'];
141-
$domain= $_POST['domain'];
152+
if ($suppress_alias_type) {
153+
$user_table = $options[0]['value'];
154+
}
142155

143-
if ($alias_username=="" || $alias_domain=="" || $username=="" || $domain=="") {
144-
$errors = "Invalid data, the entry was not modified in the database";
145-
} else {
156+
if ($user_table === NULL || !in_array($user_table, $allowed_alias_tables, true)) {
157+
$errors = "Invalid alias table";
158+
} else if ($alias_username=="" || $alias_domain=="" || $username=="" || $domain=="") {
159+
$errors = "Invalid data, the entry was not modified in the database";
160+
} else {
146161
$sql = "SELECT count(*) FROM ".$user_table." WHERE alias_username=? AND alias_domain=? AND id!=?";
147162
$stm = $link->prepare($sql);
148163
if ($stm === FALSE)
149164
die('Failed to issue query, error message : ' . print_r($link->errorInfo(), true));
150165
$stm->execute(array($alias_username, $alias_domain, $id));
151-
166+
152167
if ($stm->fetchColumn(0)>0) {
153168
$errors = "Alias already exists!";
154169
} else {
155-
156-
$sql = "UPDATE ".$user_table." SET alias_username=?, alias_domain=?, username=?, domain=? WHERE id=?";
170+
$sql = "UPDATE ".$user_table." SET alias_username=?, alias_domain=?, username=?, domain=? WHERE id=?";
157171
$stm = $link->prepare($sql);
158172
if ($stm === false) {
159173
die('Failed to issue query ['.$sql.'], error message : ' . print_r($link->errorInfo(), true));
160174
}
161175
if ($stm->execute(array($alias_username, $alias_domain, $username, $domain, $id)) == false) {
162176
$errors= "Updating record in DB failed: ".print_r($stm->errorInfo(), true);
163177
} else {
164-
$info="The alias was modified";
178+
$info="The alias was modified";
165179
}
166180
}
167-
}
168-
}else{
169-
170-
$errors= "User with Read-Only Rights";
171-
}
172-
181+
}
182+
} else {
183+
$errors= "User with Read-Only Rights";
184+
}
173185
}
174186
#################
175187
# end modify #
@@ -237,21 +249,23 @@
237249
################
238250
if ($action=="delete")
239251
{
240-
if(!$_SESSION['read_only']){
241-
242-
$id=$_GET['id'];
243-
$table=$_GET['table'];
252+
if(!$_SESSION['read_only']){
253+
$id=$_GET['id'];
254+
$table = isset($_GET['table']) ? $_GET['table'] : NULL;
255+
if ($table === NULL || !in_array($table, $allowed_alias_tables, true)) {
256+
$errors = "Invalid alias table";
257+
} else {
244258

245-
$sql = "DELETE FROM ".$table." WHERE id=?";
246-
$stm = $link->prepare($sql);
247-
if ($stm===FALSE) {
248-
die('Failed to issue query ['.$sql.'], error message : ' . print_r($link->errorInfo(), true));
259+
$sql = "DELETE FROM ".$table." WHERE id=?";
260+
$stm = $link->prepare($sql);
261+
if ($stm===FALSE) {
262+
die('Failed to issue query ['.$sql.'], error message : ' . print_r($link->errorInfo(), true));
263+
}
264+
$stm->execute( array($id) );
249265
}
250-
$stm->execute( array($id) );
251-
}else{
252-
253-
$errors= "User with Read-Only Rights";
254-
}
266+
} else {
267+
$errors= "User with Read-Only Rights";
268+
}
255269
}
256270
##############
257271
# end delete #

‎web/tools/users/alias_management/template/alias_management.edit.php‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,8 @@
2626
echo(' </tr>');
2727
}
2828
$id=$_GET['id'];
29-
30-
$sql = "select * from ".$_GET['table']." where id=?";
29+
30+
$sql = "select * from ".$user_table." where id=?";
3131
$stm = $link->prepare($sql);
3232
if ($stm === false) {
3333
die('Failed to issue query ['.$sql.'], error message : ' . print_r($link->errorInfo(), true));
@@ -39,7 +39,7 @@
3939
$index_row=0;
4040
?>
4141

42-
<form action="<?=$page_name?>?action=modify&id=<?=$_GET['id']?>&table=<?=$_GET['table']?>" method="post">
42+
<form action="<?=$page_name?>?action=modify&id=<?=$_GET['id']?>&table=<?=urlencode($user_table)?>" method="post">
4343
<?php csrfguard_generate(); ?>
4444
<table width="400" cellspacing="2" cellpadding="2" border="0">
4545
<tr align="center">
@@ -68,4 +68,3 @@
6868

6969
</table>
7070
</form>
71-

‎web/tools/users/group_management/group_management.php‎

Lines changed: 51 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -105,14 +105,19 @@
105105
#################
106106
if ($action=="edit")
107107
{
108-
109-
if(!$_SESSION['read_only']){
110-
require("template/".$page_id.".edit.php");
111-
require("template/footer.php");
112-
exit();
113-
}else{
114-
$errors= "User with Read-Only Rights";
115-
}
108+
if(!$_SESSION['read_only']){
109+
$requested_table = isset($_GET['table']) ? $_GET['table'] : $table;
110+
if ($requested_table !== $table) {
111+
$errors = "Invalid group table";
112+
} else {
113+
$table = $requested_table;
114+
require("template/".$page_id.".edit.php");
115+
require("template/footer.php");
116+
exit();
117+
}
118+
} else {
119+
$errors= "User with Read-Only Rights";
120+
}
116121
}
117122
#############
118123
# end edit #
@@ -124,21 +129,21 @@
124129
#################
125130
if ($action=="modify")
126131
{
127-
128-
$info="";
129-
$errors="";
130-
131-
if(!$_SESSION['read_only']){
132-
133-
$id = $_GET['id'];
134-
$group_username=$_POST['username'];
135-
$group_domain=$_POST['domain'];
136-
$group_grp = $_POST['group'];
137-
138-
if ($group_username=="" || $group_domain=="" || $group_grp==""){
139-
$errors = "Invalid data, the entry was not modified in the database";
140-
} else {
141-
132+
$info="";
133+
$errors="";
134+
135+
if(!$_SESSION['read_only']){
136+
$id = $_GET['id'];
137+
$requested_table = isset($_GET['table']) ? $_GET['table'] : $table;
138+
$group_username=$_POST['username'];
139+
$group_domain=$_POST['domain'];
140+
$group_grp = $_POST['group'];
141+
142+
if ($requested_table !== $table) {
143+
$errors = "Invalid group table";
144+
} else if ($group_username=="" || $group_domain=="" || $group_grp==""){
145+
$errors = "Invalid data, the entry was not modified in the database";
146+
} else {
142147
$sql = "select count(*) from subscriber where username=? and domain=?";
143148
$stm = $link->prepare($sql);
144149
if ($stm === false) {
@@ -148,8 +153,7 @@
148153
if ($stm->fetchColumn(0)<1) {
149154
$errors="This user does not exist !!!";
150155
} else {
151-
152-
$sql = "SELECT * FROM ".$table." WHERE username=? AND domain=? AND grp=? AND id!=?";
156+
$sql = "SELECT * FROM ".$table." WHERE username=? AND domain=? AND grp=? AND id!=?";
153157
$stm = $link->prepare($sql);
154158
if ($stm === false) {
155159
die('Failed to issue query ['.$sql.'], error message : ' . print_r($link->errorInfo(), true));
@@ -161,22 +165,21 @@
161165
}
162166
}
163167

164-
if ($errors=="") {
165-
$sql = "UPDATE ".$table." SET username=?, domain=?, grp=? WHERE id=?";
168+
if ($errors=="") {
169+
$sql = "UPDATE ".$table." SET username=?, domain=?, grp=? WHERE id=?";
166170
$stm = $link->prepare($sql);
167171
if ($stm === false) {
168172
die('Failed to issue query ['.$sql.'], error message : ' . print_r($link->errorInfo(), true));
169173
}
170174
if ($stm->execute( array($group_username, $group_domain, $group_grp, $id) ) == false) {
171175
$errors= "Updating record in DB failed: ".print_r($stm->errorInfo(), true);
172176
} else {
173-
$info="The Group was modified";
177+
$info="The Group was modified";
174178
}
175-
}
176-
}else{
177-
$errors= "User with Read-Only Rights";
178-
}
179-
179+
}
180+
} else {
181+
$errors= "User with Read-Only Rights";
182+
}
180183
}
181184
#################
182185
# end modify #
@@ -260,19 +263,21 @@
260263
if ($action=="delete")
261264
{
262265
if(!$_SESSION['read_only']){
263-
264-
$id=$_GET['id'];
265-
$table=$_GET['table'];
266-
267-
$sql = "DELETE FROM ".$table." WHERE id=?";
268-
$stm = $link->prepare($sql);
269-
if ($stm === false) {
270-
die('Failed to issue query ['.$sql.'], error message : ' . print_r($link->errorInfo(), true));
271-
}
272-
$stm->execute( array($id) );
273-
}else{
274-
275-
$errors= "User with Read-Only Rights";
266+
$id=$_GET['id'];
267+
$requested_table = isset($_GET['table']) ? $_GET['table'] : NULL;
268+
if ($requested_table !== $table) {
269+
$errors = "Invalid group table";
270+
} else {
271+
$table = $requested_table;
272+
$sql = "DELETE FROM ".$table." WHERE id=?";
273+
$stm = $link->prepare($sql);
274+
if ($stm === false) {
275+
die('Failed to issue query ['.$sql.'], error message : ' . print_r($link->errorInfo(), true));
276+
}
277+
$stm->execute( array($id) );
278+
}
279+
} else {
280+
$errors= "User with Read-Only Rights";
276281
}
277282
}
278283
##############

‎web/tools/users/group_management/template/group_management.edit.php‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@
4141
$index_row=0;
4242
?>
4343

44-
<form action="<?=$page_name?>?action=modify&id=<?=$_GET['id']?>&table=<?=$_GET['table']?>" method="post">
44+
<form action="<?=$page_name?>?action=modify&id=<?=$_GET['id']?>&table=<?=urlencode($table)?>" method="post">
4545
<?php csrfguard_generate(); ?>
4646
<table width="400" cellspacing="2" cellpadding="2" border="0">
4747
<table width="400" cellspacing="2" cellpadding="2" border="0">
@@ -70,4 +70,3 @@
7070

7171
</table>
7272
</form>
73-

0 commit comments

Comments
 (0)