ZaneYork
/
zoneminder
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'fix_sql_injection' into storageareas

This commit is contained in:
Isaac Connor 2016-12-08 14:58:50 -05:00
parent d97c1f1cff d600eb0e8b
commit ced701f56f
3 changed files with 85 additions and 43 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
web/ajax/log.php
View File

@ -1,5 +1,9 @@
<?php <?php
# Moved up here because it is used in several spots.
# These are the valid columns that you can filter on.
$filterFields = array( 'Component', 'ServerId', 'Pid', 'Level', 'File', 'Line' );
switch ( $_REQUEST['task'] ) switch ( $_REQUEST['task'] )
{ {
case 'create' : case 'create' :
@ -40,14 +44,26 @@ switch ( $_REQUEST['task'] )
$minTime = isset($_POST['minTime'])?$_POST['minTime']:NULL; $minTime = isset($_POST['minTime'])?$_POST['minTime']:NULL;
$maxTime = isset($_POST['maxTime'])?$_POST['maxTime']:NULL; $maxTime = isset($_POST['maxTime'])?$_POST['maxTime']:NULL;
$limit = isset($_POST['limit'])?$_POST['limit']:100; $limit = 100;
$filter = isset($_POST['filter'])?$_POST['filter']:array(); if ( isset($_POST['limit']) ) {
$sortField = isset($_POST['sortField'])?$_POST['sortField']:'TimeKey'; if ( ! is_integer( $_POST['limit'] ) ) {
Error("Invalid value for limit " . ?$_POST['limit'] );
} else {
$limit = $_POST['limit'];
}
}
$sortField = 'TimeKey';
if ( isset($_POST['sortField']) ) {
if ( ! in_array( $_POST['sortField'], $filterFields ) and ( $_POST['sortField'] != 'TimeKey' ) ) {
Error("Invalid sort field " . $_POST['sortField'] );
} else {
$sortField = $_POST['sortField']
}
}
$sortOrder = (isset($_POST['sortOrder']) and $_POST['sortOrder']) == 'asc' ? 'asc':'desc'; $sortOrder = (isset($_POST['sortOrder']) and $_POST['sortOrder']) == 'asc' ? 'asc':'desc';
$filter = isset($_POST['filter'])?$_POST['filter']:array();
$filterFields = array( 'Component', 'ServerId', 'Pid', 'Level', 'File', 'Line' ); $total = dbFetchOne( 'SELECT count(*) AS Total FROM Logs', 'Total' );
$total = dbFetchOne( "SELECT count(*) AS Total FROM Logs", 'Total' );
$sql = 'SELECT * FROM Logs'; $sql = 'SELECT * FROM Logs';
$where = array(); $where = array();
$values = array(); $values = array();
@ -58,7 +74,12 @@ switch ( $_REQUEST['task'] )
$where[] = "TimeKey < ?"; $where[] = "TimeKey < ?";
$values[] = $maxTime; $values[] = $maxTime;
} }
foreach ( $filter as $field=>$value ) { foreach ( $filter as $field=>$value ) {
if ( ! in_array( $field, $fileFields ) ) {
Error("$field is not in valid filter fields");
continue;
}
if ( $field == 'Level' ){ if ( $field == 'Level' ){
$where[] = $field." <= ?"; $where[] = $field." <= ?";
$values[] = $value; $values[] = $value;
@ -147,8 +168,15 @@ switch ( $_REQUEST['task'] )
} }
//$limit = isset($_POST['limit'])?$_POST['limit']:1000; //$limit = isset($_POST['limit'])?$_POST['limit']:1000;
$filter = isset($_POST['filter'])?$_POST['filter']:array(); $filter = isset($_POST['filter'])?$_POST['filter']:array();
$sortField = isset($_POST['sortField'])?$_POST['sortField']:'TimeKey'; $sortField = 'TimeKey';
$sortOrder = isset($_POST['sortOrder'])?$_POST['sortOrder']:'asc'; if ( isset($_POST['sortField']) ) {
if ( ! in_array( $_POST['sortField'], $filterFields ) and ( $_POST['sortField'] != 'TimeKey' ) ) {
Error("Invalid sort field " . $_POST['sortField'] );
} else {
$sortField = $_POST['sortField']
}
}
$sortOrder = (isset($_POST['sortOrder']) and $_POST['sortOrder']) == 'asc' ? 'asc':'desc';
$servers = Server::find_all(); $servers = Server::find_all();
$servers_by_Id = array(); $servers_by_Id = array();

10
web/includes/Frame.php
View File

@ -6,7 +6,7 @@ class Frame {
public function __construct( $IdOrRow ) { public function __construct( $IdOrRow ) {
$row = NULL; $row = NULL;
if ( $IdOrRow ) { if ( $IdOrRow ) {
if ( is_integer( $IdOrRow ) or is_numeric( $IdOrRow ) ) { if ( is_integer( $IdOrRow ) ) {
$row = dbFetchOne( 'SELECT * FROM Frames WHERE Id=?', NULL, array( $IdOrRow ) ); $row = dbFetchOne( 'SELECT * FROM Frames WHERE Id=?', NULL, array( $IdOrRow ) );
if ( ! $row ) { if ( ! $row ) {
Error("Unable to load Frame record for Id=" . $IdOrRow ); Error("Unable to load Frame record for Id=" . $IdOrRow );
@ -84,7 +84,15 @@ class Frame {
$values = array_values( $parameters ); $values = array_values( $parameters );
} }
if ( $limit ) { if ( $limit ) {
if ( is_integer( $limit ) ) {
$sql .= ' LIMIT ' . $limit; $sql .= ' LIMIT ' . $limit;
} else {
$backTrace = debug_backtrace();
$file = $backTrace[1]['file'];
$line = $backTrace[1]['line'];
Error("Invalid value for limit($limit) passed to Frame::find from $file:$line");
return;
}
} }
$results = dbFetchAll( $sql, NULL, $values ); $results = dbFetchAll( $sql, NULL, $values );
if ( $results ) { if ( $results ) {

8
web/includes/Server.php
View File

@ -63,8 +63,14 @@ class Server {
) ); ) );
$values = array_values( $parameters ); $values = array_values( $parameters );
} }
if ( $limit ) { if ( is_integer( $limit ) ) {
$sql .= ' LIMIT ' . $limit; $sql .= ' LIMIT ' . $limit;
} else {
$backTrace = debug_backtrace();
$file = $backTrace[1]['file'];
$line = $backTrace[1]['line'];
Error("Invalid value for limit($limit) passed to Server::find from $file:$line");
return;
} }
$results = dbFetchAll( $sql, NULL, $values ); $results = dbFetchAll( $sql, NULL, $values );
if ( $results ) { if ( $results ) {