Escape user token during API authentication

glpi-project · Nov 3, 2022 · 7cbb2d5 · 7cbb2d5
1 parent 8505fbf
commit 7cbb2d5
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/Api/API.php b/src/Api/API.php
@@ -282,7 +282,7 @@ protected function initSession($params = [])
 
         $noAuto = true;
         if (isset($params['user_token']) && !empty($params['user_token'])) {
-            $_REQUEST['user_token'] = $params['user_token'];
+            $_REQUEST['user_token'] = Sanitizer::dbEscape($params['user_token']);
             $noAuto = false;
         } else if (!$CFG_GLPI['enable_api_login_credentials']) {
             $this->returnError(