Navigation Menu

Skip to content

Commit

Permalink
sec(Calendar) sanitize inputs and use pquery to protect SQL
Browse files Browse the repository at this point in the history
  • Loading branch information
@joebordes
joebordes committed Jan 15, 2022
1 parent 1dc112a commit 2ce9f38
Show file tree
Hide file tree
Showing 4 changed files with 23 additions and 21 deletions.
4 changes: 2 additions & 2 deletions modules/Calendar4You/CalendarView.php
View file
Expand Up @@ -206,7 +206,7 @@
);

if (isset($_REQUEST['viewOption']) && $_REQUEST['viewOption']!= '') {
$default_view = $_REQUEST['viewOption'];
$default_view = vtlib_purify($_REQUEST['viewOption']);
} else {
if ($current_user->activity_view == 'This Year') {
$default_view = 'month';
Expand All @@ -228,7 +228,7 @@
$smarty->assign('upESTATUSBLOCK_DISPLAY', isset($Ch_Views['8']) ? $Ch_Views['8'] : 'block');
$smarty->assign('upTPRIORITYBLOCK_DISPLAY', isset($Ch_Views['9']) ? $Ch_Views['9'] : 'block');
if (isset($_REQUEST['user_view_type']) && $_REQUEST['user_view_type'] != '') {
$user_view_type = $_REQUEST['user_view_type'];
$user_view_type = vtlib_purify($_REQUEST['user_view_type']);
} else {
if ($Calendar_Settings['user_view']== 'all') {
$user_view_type = 'all';
Expand Down
14 changes: 8 additions & 6 deletions modules/Calendar4You/Events.php
View file
Expand Up @@ -26,12 +26,12 @@
$save = (isset($_REQUEST['save']) ? vtlib_purify($_REQUEST['save']) : '');
$full_calendar_view = vtlib_purify($_REQUEST['view']);
if (isset($_REQUEST['record']) && $_REQUEST['record'] != '') {
$record = $_REQUEST['record'];
$record = vtlib_purify($_REQUEST['record']);
}

if (!empty($_REQUEST['usersids'])) {
$all_users = true;
$Users_Ids = explode(',', $_REQUEST['usersids']);
$Users_Ids = explode(',', vtlib_purify($_REQUEST['usersids']));
} else {
$all_users = false;
if ($user_view_type != 'all') {
Expand Down Expand Up @@ -169,7 +169,7 @@
$showGroupEvents = GlobalVariable::getVariable('Calendar_Show_Group_Events', 1);
$modtab = array_flip($tasklabel);
foreach ($Users_Ids as $userid) {
if (!$userid) {
if (empty($userid) || !is_numeric($userid)) {
continue;
}
if ($showGroupEvents) {
Expand Down Expand Up @@ -264,10 +264,12 @@
} else {
$list_query = getCalendar4YouListQuery($userid, $invites);
if ($record != '') {
$list_query .= " AND vtiger_crmentity.crmid = '".$record."'";
$list_query .= ' AND vtiger_crmentity.crmid=?';
$list_array[] = $record;
} else {
$list_query .= " AND vtiger_activity.dtstart <= '".$usredtime."'";
$list_query .= " AND vtiger_activity.dtend >= '".$usrsttime."'";
$list_query .= ' AND vtiger_activity.dtstart<=? AND vtiger_activity.dtend>=?';
$list_array[] = $usredtime;
$list_array[] = $usrsttime;
}
if (!$invites) {
if ($showGroupEvents && $groups != '') {
Expand Down
8 changes: 4 additions & 4 deletions modules/Calendar4You/SaveEventSettings.php
View file
Expand Up @@ -10,7 +10,7 @@
require_once 'include/database/PearDatabase.php';
global $adb,$current_user;

$user_view_type = $_REQUEST['user_view_type'];
$user_view_type = vtlib_purify($_REQUEST['user_view_type']);

$mode = vtlib_purify($_REQUEST['mode']);
if ($mode=='module') {
Expand All @@ -29,7 +29,7 @@
}

$Save_Data = array();
$save_fields = $_REQUEST['save_fields'];
$save_fields = vtlib_purify($_REQUEST['save_fields']);

if ($save_fields == '1') {
$event = $entity;
Expand All @@ -40,9 +40,9 @@
$Views = array('day','week','month');

foreach ($Views as $view) {
$Save_Data[] = array($userid,$event,'1',$view,$_REQUEST[$view.'_showed_field']);
$Save_Data[] = array($userid,$event,'1',$view,vtlib_purify($_REQUEST[$view.'_showed_field']));

$Selected_Fields = explode(';', $_REQUEST[$view.'_selected_fields']);
$Selected_Fields = explode(';', vtlib_purify($_REQUEST[$view.'_selected_fields']));

if (count($Selected_Fields) > 0) {
foreach ($Selected_Fields as $fieldname) {
Expand Down
18 changes: 9 additions & 9 deletions modules/Calendar4You/updateCalendarSharing.php
View file
Expand Up @@ -17,28 +17,28 @@
$hour_format = '12';
}

$activity_view = $_REQUEST['activity_view'];
$activity_view = vtlib_purify($_REQUEST['activity_view']);

$user_view = $_REQUEST['user_view'];
$user_view = vtlib_purify($_REQUEST['user_view']);

$adb->pquery('delete from vtiger_sharedcalendar where userid=?', array($_REQUEST['current_userid']));
$adb->pquery('delete from vtiger_sharedcalendar where userid=?', array(vtlib_purify($_REQUEST['current_userid'])));

$selectedid = $_REQUEST['shar_userid'];
$selectedid = vtlib_purify($_REQUEST['shar_userid']);
$sharedid = explode(';', $selectedid);
if (isset($sharedid) && $sharedid != null) {
foreach ($sharedid as $sid) {
if ($sid != '') {
$adb->pquery('insert into vtiger_sharedcalendar values (?,?)', array($_REQUEST['current_userid'], $sid));
$adb->pquery('insert into vtiger_sharedcalendar values (?,?)', array(vtlib_purify($_REQUEST['current_userid']), $sid));
}
}
}
if (isset($_REQUEST['start_hour']) && $_REQUEST['start_hour'] != '') {
$adb->pquery('update vtiger_users set start_hour=? where id=?', array($_REQUEST['start_hour'], $current_user->id));
$adb->pquery('update vtiger_users set start_hour=? where id=?', array(vtlib_purify($_REQUEST['start_hour']), $current_user->id));
}

$adb->pquery('update vtiger_users set hour_format=?, activity_view=? where id=?', array($hour_format, $activity_view, $current_user->id));

$dayoftheweek = $_REQUEST['dayoftheweek'];
$dayoftheweek = vtlib_purify($_REQUEST['dayoftheweek']);

if (isset($_REQUEST['show_weekends']) && $_REQUEST['show_weekends'] == '1') {
$show_weekends = '1';
Expand All @@ -57,7 +57,7 @@
$adb->pquery($sql3, array($current_user->id, $dayoftheweek, $show_weekends, $user_view));
}

$update_google_account = (isset($_REQUEST['update_google_account']) ? $_REQUEST['update_google_account'] : '0');
$update_google_account = (isset($_REQUEST['update_google_account']) ? vtlib_purify($_REQUEST['update_google_account']) : '0');

if ($update_google_account == '1') {
$google_login = vtlib_purify($_REQUEST['google_login']);
Expand Down Expand Up @@ -92,6 +92,6 @@

RecalculateSharingRules();
$url = 'Location: index.php?action=index&module=Calendar4You&viewOption='.vtlib_purify($_REQUEST['view']).'&hour='.vtlib_purify($_REQUEST['hour'])
.'&day='.vtlib_purify($_REQUEST['day']).'&month='.vtlib_purify($_REQUEST['month']).'&year='.vtlib_purify($_REQUEST['year']).'&user_view_type='.$user_view;
.'&day='.vtlib_purify($_REQUEST['day']).'&month='.vtlib_purify($_REQUEST['month']).'&year='.vtlib_purify($_REQUEST['year']).'&user_view_type='.urlencode($user_view);
header($url);
?>

0 comments on commit 2ce9f38

Please sign in to comment.