Fix SQL injection sanitize all $_REQUEST keys

francoisjacquet · Apr 23, 2022 · a06112e · a06112e
1 parent 81fd18d
commit a06112e
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 4 deletions.
diff --git a/CHANGES.md b/CHANGES.md
@@ -1,6 +1,10 @@
 # CHANGES
 ## RosarioSIS Student Information System
 
+Changes in 8.9.4
+----------------
+- Fix SQL injection sanitize all `$_REQUEST` keys in Warehouse.php, thanks to @nhienit2010
+
 Changes in 8.9.3
 ----------------
 - Fix stored XSS security issue: do not allow unsanitized SVG in FileUpload.fnc.php, thanks to @scgajge12 & @crowdoverflow

diff --git a/Warehouse.php b/Warehouse.php
@@ -191,11 +191,11 @@ function array_rwalk( &$array, $function )
 		if ( is_array( $array[$key[$i]] ) )
 		{
 			array_rwalk( $array[$key[$i]], $function );
-
-			continue;
 		}
-
-		$array[$key[$i]] = $function( $array[$key[$i]] );
+		else
+		{
+			$array[$key[$i]] = $function( $array[$key[$i]] );
+		}
 
 		// Key is also passed through $function function.
 		$fkey = $function( $key[$i] );