From 6aafca34f05e6c37bae99fb8224f2abaff0426fd Mon Sep 17 00:00:00 2001 From: Mark Crane Date: Fri, 27 Sep 2013 03:24:09 +0000 Subject: [PATCH] Security enhancement for the content manager. --- resources/header.php | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/resources/header.php b/resources/header.php index 1650284b61..52f2c7e706 100644 --- a/resources/header.php +++ b/resources/header.php @@ -89,18 +89,20 @@ require_once "resources/require.php"; //get the content if (file_exists($_SERVER['DOCUMENT_ROOT'].PROJECT_PATH."/app/content/app_config.php")) { $sql = "select * from v_rss "; - $sql .= "where domain_uuid = '".$_SESSION['domain_uuid']."' "; + $sql .= "where domain_uuid =:domain_uuid "; $sql .= "and rss_category = 'content' "; - if (strlen($content) == 0) { - $sql .= "and rss_link = '".$_SERVER["PHP_SELF"]."' "; - } - else { - $sql .= "and rss_link = '".$content."' "; - } + $sql .= "and rss_link =:content "; $sql .= "and (length(rss_del_date) = 0 "; $sql .= "or rss_del_date is null) "; $sql .= "order by rss_order asc "; $content_prep_statement = $db->prepare(check_sql($sql)); + $content_prep_statement->bindParam(':domain_uuid', $_SESSION['domain_uuid']); + if (strlen($content) == 0) { + $content_prep_statement->bindParam(':content', $_SERVER["PHP_SELF"]); + } + else { + $content_prep_statement->bindParam(':content', $content); + } $content_prep_statement->execute(); $result = $content_prep_statement->fetchAll(PDO::FETCH_NAMED); $page["title"] = '';