mirror/zoneminder
1
0
Fork 0
mirror of https://github.com/ZoneMinder/zoneminder.git synced 2026-03-17 13:27:46 -04:00
Code Issues Packages Projects Releases Wiki Activity

Sanitise attr input in FilterTerm to prefent SQL Injection. Fixes GHSA-222j-wh8m-xjrx

Browse Source
This commit is contained in:
Isaac Connor
2023-02-23 09:24:56 -05:00
parent 89f0565edc
commit 32afb13b39
1 changed files with 3 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
web/includes/FilterTerm.php
View File

@@ -1,5 +1,4 @@
<?php
namespace ZM;
$validConjunctionTypes = null;
@@ -13,7 +12,6 @@ function getFilterQueryConjunctionTypes() {
return $validConjunctionTypes;
}
class FilterTerm {
public $filter;
public $index;
@@ -25,7 +23,6 @@ class FilterTerm {
public $obr;
public $cbr;
public function __construct($filter = null, $term = null, $index=0) {
$this->filter = $filter;
$validConjunctionTypes = getFilterQueryConjunctionTypes();
@@ -33,6 +30,8 @@ class FilterTerm {
$this->index = $index;
if ($term) {
$this->attr = isset($term['attr']) ? $term['attr'] : '';
$this->attr = preg_replace('/[^A-Za-z0-9\.]/', '', $this->attr, -1, $count);
if ($count) Error("Invalid characters removed from filter attr ${term['attr']}, possible hacking attempt.");
$this->op = $term['op'];
$this->val = $term['val'];
if ( isset($term['cnj']) ) {
@@ -72,7 +71,7 @@ class FilterTerm {
public function sql_values() {
$values = array();
if ( !isset($this->val) ) {
Warning('No value in term'.$this->attr);
Warning('No value in term '.$this->attr);
return $values;
}
@@ -80,7 +79,6 @@ class FilterTerm {
foreach ( $vals as $value ) {
$value_upper = strtoupper($value);
switch ( $this->attr ) {
case 'AlarmedZoneId':
$value = '(SELECT * FROM Stats WHERE EventId=E.Id AND ZoneId='.$value.' AND Score > 0 LIMIT 1)';
break;
@@ -91,7 +89,6 @@ class FilterTerm {
$value = '';
break;
case 'MonitorName':
case 'MonitorName':
case 'Name':
case 'Cause':
case 'Notes':