Skip to content

Commit

Permalink
Blind sql injection fixes rework (#3284)
Browse files Browse the repository at this point in the history
  • Loading branch information
@jekkos
jekkos committed Sep 28, 2021
1 parent 6ef764d commit e9bf68d
Show file tree
Hide file tree
Showing 31 changed files with 110 additions and 16 deletions.
2 changes: 1 addition & 1 deletion application/controllers/Attributes.php
View file
Expand Up @@ -24,7 +24,7 @@ public function search()
$search = $this->input->get('search');
$limit = $this->input->get('limit');
$offset = $this->input->get('offset');
$sort = $this->input->get('sort');
$sort = $this->Attribute->sort_column($this->input->get('sort'));
$order = $this->input->get('order');

$attributes = $this->Attribute->search($search, $limit, $offset, $sort, $order);
Expand Down
2 changes: 1 addition & 1 deletion application/controllers/Cashups.php
View file
Expand Up @@ -25,7 +25,7 @@ public function search()
$search = $this->input->get('search');
$limit = $this->input->get('limit');
$offset = $this->input->get('offset');
$sort = $this->input->get('sort');
$sort = $this->Cashup->sort_column($this->input->get('sort'));
$order = $this->input->get('order');
$filters = array(
'start_date' => $this->input->get('start_date'),
Expand Down
2 changes: 1 addition & 1 deletion application/controllers/Customers.php
View file
Expand Up @@ -58,7 +58,7 @@ public function search()
$search = $this->input->get('search');
$limit = $this->input->get('limit');
$offset = $this->input->get('offset');
$sort = $this->input->get('sort');
$sort = $this->Customer->sort_column($this->input->get('sort'));
$order = $this->input->get('order');

$customers = $this->Customer->search($search, $limit, $offset, $sort, $order);
Expand Down
2 changes: 1 addition & 1 deletion application/controllers/Employees.php
View file
Expand Up @@ -17,7 +17,7 @@ public function search()
$search = $this->input->get('search');
$limit = $this->input->get('limit');
$offset = $this->input->get('offset');
$sort = $this->input->get('sort');
$sort = $this->Employee->sort_column($this->input->get('sort'));
$order = $this->input->get('order');

$employees = $this->Employee->search($search, $limit, $offset, $sort, $order);
Expand Down
2 changes: 1 addition & 1 deletion application/controllers/Expenses.php
View file
Expand Up @@ -30,7 +30,7 @@ public function search()
$search = $this->input->get('search');
$limit = $this->input->get('limit');
$offset = $this->input->get('offset');
$sort = $this->input->get('sort');
$sort = $this->Expense->sort_column($this->input->get('sort'));
$order = $this->input->get('order');
$filters = array(
'start_date' => $this->input->get('start_date'),
Expand Down
2 changes: 1 addition & 1 deletion application/controllers/Expenses_categories.php
View file
Expand Up @@ -24,7 +24,7 @@ public function search()
$search = $this->input->get('search');
$limit = $this->input->get('limit');
$offset = $this->input->get('offset');
$sort = $this->input->get('sort');
$sort = $this->Expense_category->sort_column($this->input->get('sort'));
$order = $this->input->get('order');

$expense_categories = $this->Expense_category->search($search, $limit, $offset, $sort, $order);
Expand Down
2 changes: 1 addition & 1 deletion application/controllers/Giftcards.php
View file
Expand Up @@ -24,7 +24,7 @@ public function search()
$search = $this->input->get('search');
$limit = $this->input->get('limit');
$offset = $this->input->get('offset');
$sort = $this->input->get('sort');
$sort = $this->Giftcard->sort_column($this->input->get('sort'));
$order = $this->input->get('order');

$giftcards = $this->Giftcard->search($search, $limit, $offset, $sort, $order);
Expand Down
2 changes: 1 addition & 1 deletion application/controllers/Item_kits.php
View file
Expand Up @@ -59,7 +59,7 @@ public function search()
$search = $this->input->get('search');
$limit = $this->input->get('limit');
$offset = $this->input->get('offset');
$sort = $this->input->get('sort');
$sort = $this->Item_kit->sort_column($this->input->get('sort'));
$order = $this->input->get('order');

$item_kits = $this->Item_kit->search($search, $limit, $offset, $sort, $order);
Expand Down
2 changes: 1 addition & 1 deletion application/controllers/Items.php
View file
Expand Up @@ -40,7 +40,7 @@ public function search()
$search = $this->input->get('search');
$limit = $this->input->get('limit');
$offset = $this->input->get('offset');
$sort = $this->input->get('sort');
$sort = $this->Item->sort_column($this->input->get('sort'));
$order = $this->input->get('order');

$this->item_lib->set_item_location($this->input->get('stock_location'));
Expand Down
2 changes: 1 addition & 1 deletion application/controllers/Sales.php
View file
Expand Up @@ -56,7 +56,7 @@ public function search()
$search = $this->input->get('search');
$limit = $this->input->get('limit');
$offset = $this->input->get('offset');
$sort = $this->input->get('sort');
$sort = $this->Sale->sort_column($this->input->get('sort'));
$order = $this->input->get('order');

$filters = array('sale_type' => 'all',
Expand Down
2 changes: 1 addition & 1 deletion application/controllers/Suppliers.php
View file
Expand Up @@ -35,7 +35,7 @@ public function search()
$search = $this->input->get('search');
$limit = $this->input->get('limit');
$offset = $this->input->get('offset');
$sort = $this->input->get('sort');
$sort = $this->Supplier->sort_column($this->input->get('sort'));
$order = $this->input->get('order');

$suppliers = $this->Supplier->search($search, $limit, $offset, $sort, $order);
Expand Down
3 changes: 1 addition & 2 deletions application/controllers/Tax_categories.php
View file
Expand Up @@ -9,7 +9,6 @@ public function __construct()
parent::__construct('tax_categories');
}


public function index()
{
$data['tax_categories_table_headers'] = $this->xss_clean(get_tax_categories_table_headers());
Expand All @@ -25,7 +24,7 @@ public function search()
$search = $this->input->get('search');
$limit = $this->input->get('limit');
$offset = $this->input->get('offset');
$sort = $this->input->get('sort');
$sort = $this->Tax_category->sort_column($this->input->get('sort'));
$order = $this->input->get('order');

$tax_categories = $this->Tax_category->search($search, $limit, $offset, $sort, $order);
Expand Down
2 changes: 1 addition & 1 deletion application/controllers/Tax_codes.php
View file
Expand Up @@ -29,7 +29,7 @@ public function search()
$search = $this->input->get('search');
$limit = $this->input->get('limit');
$offset = $this->input->get('offset');
$sort = $this->input->get('sort');
$sort = $this->Tax_code->sort_column($this->input->get('sort'));
$order = $this->input->get('order');

$tax_codes = $this->Tax_code->search($search, $limit, $offset, $sort, $order);
Expand Down
2 changes: 1 addition & 1 deletion application/controllers/Tax_jurisdictions.php
View file
Expand Up @@ -25,7 +25,7 @@ public function search()
$search = $this->input->get('search');
$limit = $this->input->get('limit');
$offset = $this->input->get('offset');
$sort = $this->input->get('sort');
$sort = $this->Tax_jurisdiction->sort_column($this->input->get('sort'));
$order = $this->input->get('order');

$tax_jurisdictions = $this->Tax_jurisdiction->search($search, $limit, $offset, $sort, $order);
Expand Down
2 changes: 1 addition & 1 deletion application/controllers/Taxes.php
View file
Expand Up @@ -57,7 +57,7 @@ public function search()
$search = $this->input->get('search');
$limit = $this->input->get('limit');
$offset = $this->input->get('offset');
$sort = $this->input->get('sort');
$sort = $this->Tax->sort_column($this->input->get('sort'));
$order = $this->input->get('order');

$tax_rates = $this->Tax->search($search, $limit, $offset, $sort, $order);
Expand Down
5 changes: 5 additions & 0 deletions application/models/Attribute.php
View file
Expand Up @@ -16,6 +16,11 @@ public static function get_definition_flags()
return array_flip($class->getConstants());
}

public function sort_column($field)
{
return in_array($field, $this->db->list_fields('attribute_definitions')) ? $field : 'definition_id';
}

/*
Determines if a given definition_id is an attribute
*/
Expand Down
6 changes: 6 additions & 0 deletions application/models/Cashup.php
View file
Expand Up @@ -6,6 +6,12 @@

class Cashup extends CI_Model
{

public function sort_column($field)
{
return in_array($field, $this->db->list_fields('cash_up')) ? $field : 'cashup_id';
}

/*
Determines if a given Cashup_id is an Cashup
*/
Expand Down
6 changes: 6 additions & 0 deletions application/models/Customer.php
View file
Expand Up @@ -6,6 +6,12 @@

class Customer extends Person
{

public function sort_column($field)
{
return in_array($field, $this->db->list_fields('customers')) ? $field : 'people.person_id';
}

/*
Determines if a given person_id is a customer
*/
Expand Down
6 changes: 6 additions & 0 deletions application/models/Employee.php
View file
Expand Up @@ -6,6 +6,12 @@

class Employee extends Person
{

public function sort_column($field)
{
return in_array($field, $this->db->list_fields('employees')) ? $field : 'people.person_id';
}

/*
Determines if a given person_id is an employee
*/
Expand Down
6 changes: 6 additions & 0 deletions application/models/Expense.php
View file
Expand Up @@ -6,6 +6,12 @@

class Expense extends CI_Model
{

public function sort_column($field)
{
return in_array($field, $this->db->list_fields('expenses')) ? $field : 'expense_id';
}

/*
Determines if a given Expense_id is an Expense
*/
Expand Down
6 changes: 6 additions & 0 deletions application/models/Expense_category.php
View file
Expand Up @@ -6,6 +6,12 @@

class Expense_category extends CI_Model
{

public function sort_column($field)
{
return in_array($field, $this->db->list_fields('expense_categories')) ? $field : 'expense_category_id';
}

/*
Determines if a given Expense_id is an Expense category
*/
Expand Down
6 changes: 6 additions & 0 deletions application/models/Giftcard.php
View file
Expand Up @@ -6,6 +6,12 @@

class Giftcard extends CI_Model
{

public function sort_column($field)
{
return in_array($field, $this->db->list_fields('giftcards')) ? $field : 'giftcard_id';
}

/*
Determines if a given giftcard_id is a giftcard
*/
Expand Down
7 changes: 7 additions & 0 deletions application/models/Item.php
View file
Expand Up @@ -5,6 +5,13 @@

class Item extends CI_Model
{

public function sort_column($field)
{
$allowed_columns = array_merge($this->db->list_fields('items'), $this->db->list_fields('item_quantities'));
return in_array($field, $allowed_columns) ? $field : 'item_id';
}

/*
Determines if a given item_id is an item
*/
Expand Down
6 changes: 6 additions & 0 deletions application/models/Item_kit.php
View file
Expand Up @@ -6,6 +6,12 @@

class Item_kit extends CI_Model
{

public function sort_column($field)
{
return in_array($field, $this->db->list_fields('item_kits')) ? $field : 'item_kit_id';
}

/*
Determines if a given item_id is an item kit
*/
Expand Down
6 changes: 6 additions & 0 deletions application/models/Item_taxes.php
View file
Expand Up @@ -6,6 +6,12 @@

class Item_taxes extends CI_Model
{

public function sort_column($field)
{
return in_array($field, $this->db->list_fields('items_taxes')) ? $field : 'item_id';
}

/*
Gets tax info for a particular item
*/
Expand Down
6 changes: 6 additions & 0 deletions application/models/Sale.php
View file
Expand Up @@ -4,6 +4,12 @@
*/
class Sale extends CI_Model
{

public function sort_column($field)
{
return in_array($field, $this->db->list_fields('sales')) ? $field : 'sale_id';
}

/**
* Get sale info
*/
Expand Down
5 changes: 5 additions & 0 deletions application/models/Supplier.php
View file
Expand Up @@ -9,6 +9,11 @@ class Supplier extends Person
const GOODS_SUPPLIER = 0;
const COST_SUPPLIER = 1;

public function sort_column($field)
{
return in_array($field, $this->db->list_fields('suppliers')) ? $field : 'people.person_id';
}

/*
Determines if a given person_id is a customer
*/
Expand Down
6 changes: 6 additions & 0 deletions application/models/Tax.php
View file
Expand Up @@ -6,6 +6,12 @@

class Tax extends CI_Model
{

public function sort_column($field)
{
return in_array($field, $this->db->list_fields('tax_codes')) ? $field : 'tax_code_id';
}

/**
* Determines if a given row is on file
*/
Expand Down
6 changes: 6 additions & 0 deletions application/models/Tax_category.php
View file
Expand Up @@ -6,6 +6,12 @@

class Tax_category extends CI_Model
{

public function sort_column($field)
{
return in_array($field, $this->db->list_fields('tax_categories')) ? $field : 'tax_category_id';
}

/**
* Determines if it exists in the table
*/
Expand Down
6 changes: 6 additions & 0 deletions application/models/Tax_code.php
View file
Expand Up @@ -6,6 +6,12 @@

class Tax_code extends CI_Model
{

public function sort_column($field)
{
return in_array($field, $this->db->list_fields('tax_codes')) ? $field : 'tax_code_id';
}

/**
* Determines if it exists in the table
*/
Expand Down
6 changes: 6 additions & 0 deletions application/models/Tax_jurisdiction.php
View file
Expand Up @@ -6,6 +6,12 @@

class Tax_jurisdiction extends CI_Model
{

public function sort_column($field)
{
return in_array($field, $this->db->list_fields('tax_jurisdictions')) ? $field : 'jurisdiction_id';
}

/**
* Determines if it exists in the table
*/
Expand Down

0 comments on commit e9bf68d

Please sign in to comment.