← Back to branch summary

~ubuntu-branches/ubuntu/jaunty/glpi/jaunty

« back to all changes in this revision

Viewing changes to ajax/autocompletion.php

  • Committer: Bazaar Package Importer
  • Author(s): Pierre Chifflier
  • Date: 2009-02-01 18:00:16 UTC
  • mfrom: (1.1.5 upstream) (2.1.4 sid)
  • Revision ID: james.westby@ubuntu.com-20090201180016-ddwxt4vrbqvv23pa
Tags: 0.71.5-1
http://bugs.debian.org/513611
* New upstream release
* Security: fix SQL injection in ID field (Closes: #513611)
* Urgency high due to security fix.

Show diffs side-by-side

added added

removed removed

Lines of Context:
ajax/autocompletion.php
1
1
<?php
2
2
/*
3
 
 * @version $Id: autocompletion.php 6217 2008-01-01 01:32:45Z moyo $
 
3
 * @version $Id: autocompletion.php 7882 2009-01-23 18:24:05Z moyo $
4
4
 -------------------------------------------------------------------------
5
5
 GLPI - Gestionnaire Libre de Parc Informatique
6
 
 Copyright (C) 2003-2008 by the INDEPNET Development Team.
 
6
 Copyright (C) 2003-2009 by the INDEPNET Development Team.
7
7
 
8
8
 http://indepnet.net/   http://glpi-project.org
9
9
 -------------------------------------------------------------------------
49
49
        $entity=" AND FK_entities='".$_POST['entity_restrict']."' ";
50
50
}
51
51
 
52
 
$query="SELECT DISTINCT ".$_POST['field']." AS VAL FROM ".$_POST['table']." WHERE ".$_POST['field']." LIKE '".$_POST[$_POST['myname']]."%' AND ".$_POST['field']." <> '".$_POST[$_POST['myname']]."' $entity ORDER BY ".$_POST['field']." LIMIT 0,20";
 
52
$query="SELECT DISTINCT `".$_POST['field']."` AS VAL FROM `".$_POST['table']."` WHERE `".$_POST['field']."` LIKE '".$_POST[$_POST['myname']]."%' AND `".$_POST['field']."` <> '".$_POST[$_POST['myname']]."' $entity ORDER BY `".$_POST['field']."` LIMIT 0,20";
53
53
if ($result=$DB->query($query))
54
54
        if ($DB->numrows($result)>0){
55
55
                echo "<ul class='autocomp'>";