diff --git a/web/zm_funcs.php b/web/zm_funcs.php index 51c974a72..2ccda8759 100644 --- a/web/zm_funcs.php +++ b/web/zm_funcs.php @@ -1218,20 +1218,20 @@ function parseFilter( &$filter, $save_to_session=false, $term_sep='&' ) { if ( isset($filter['terms'][$i]['cnj']) ) { - $filter['query'] .= $term_sep."filter[terms][$i][cnj]=".$filter['terms'][$i]['cnj']; + $filter['query'] .= $term_sep."filter[terms][$i][cnj]=".urlencode($filter['terms'][$i]['cnj']); $filter['sql'] .= " ".$filter['terms'][$i]['cnj']." "; - $filter['fields'] .= "\n"; + $filter['fields'] .= "\n"; } if ( isset($filter['terms'][$i]['obr']) ) { - $filter['query'] .= $term_sep."filter[terms][$i][obr]=".$filter['terms'][$i]['obr']; + $filter['query'] .= $term_sep."filter[terms][$i][obr]=".urlencode($filter['terms'][$i]['obr']); $filter['sql'] .= " ".str_repeat( "(", $filter['terms'][$i]['obr'] )." "; - $filter['fields'] .= "\n"; + $filter['fields'] .= "\n"; } if ( isset($filter['terms'][$i]['attr']) ) { - $filter['query'] .= $term_sep."filter[terms][$i][attr]=".$filter['terms'][$i]['attr']; - $filter['fields'] .= "\n"; + $filter['query'] .= $term_sep."filter[terms][$i][attr]=".urlencode($filter['terms'][$i]['attr']); + $filter['fields'] .= "\n"; switch ( $filter['terms'][$i]['attr'] ) { case 'MonitorName': @@ -1282,7 +1282,7 @@ function parseFilter( &$filter, $save_to_session=false, $term_sep='&' ) case 'Name': case 'Cause': case 'Notes': - $value = "'$value'"; + $value = "'".dbEscape($value)."'"; break; case 'DateTime': $value = "'".strftime( STRF_FMT_DATETIME_DB, strtotime( $value ) )."'"; @@ -1321,16 +1321,16 @@ function parseFilter( &$filter, $save_to_session=false, $term_sep='&' ) break; } - $filter['query'] .= $term_sep."filter[terms][$i][op]=".$filter['terms'][$i]['op']; - $filter['fields'] .= "\n"; - $filter['query'] .= $term_sep."filter[terms][$i][val]=".urlencode($filter['terms'][$i]['val']); - $filter['fields'] .= "\n"; + $filter['query'] .= $term_sep."filter[terms][$i][op]=".urlencode($filter['terms'][$i]['op']); + $filter['fields'] .= "\n"; + $filter['query'] .= $term_sep."filter[terms][$i][val]=".urlencode(urlencode($filter['terms'][$i]['val'])); + $filter['fields'] .= "\n"; } if ( isset($filter['terms'][$i]['cbr']) ) { - $filter['query'] .= $term_sep."filter[terms][$i][cbr]=".$filter['terms'][$i]['cbr']; + $filter['query'] .= $term_sep."filter[terms][$i][cbr]=".urlencode($filter['terms'][$i]['cbr']); $filter['sql'] .= " ".str_repeat( ")", $filter['terms'][$i]['cbr'] )." "; - $filter['fields'] .= "\n"; + $filter['fields'] .= "\n"; } } if ( $filter['sql'] ) diff --git a/web/zm_html_view_event.php b/web/zm_html_view_event.php index d525208fc..768408700 100644 --- a/web/zm_html_view_event.php +++ b/web/zm_html_view_event.php @@ -46,7 +46,7 @@ $event = dbFetchOne( $sql ); parseSort(); parseFilter( $filter ); -$sql = "select E.* from Events as E inner join Monitors as M on E.MonitorId = M.Id where $sort_column ".($sort_order=='asc'?'<=':'>=')." '".$event[preg_replace( '/^.*\./', '', $sort_column )]."'$filter_sql$mid_sql order by $sort_column ".($sort_order=='asc'?'desc':'asc'); +$sql = "select E.* from Events as E inner join Monitors as M on E.MonitorId = M.Id where $sort_column ".($sort_order=='asc'?'<=':'>=')." '".$event[preg_replace( '/^.*\./', '', $sort_column )]."'".$filter['sql'].$mid_sql." order by $sort_column ".($sort_order=='asc'?'desc':'asc')." limit 100"; $result = dbQuery( $sql ); foreach( dbFetchAll( $sql ) as $row ) while ( $row = dbFetchNext( $result ) ) @@ -58,7 +58,7 @@ while ( $row = dbFetchNext( $result ) ) } } -$sql = "select E.* from Events as E inner join Monitors as M on E.MonitorId = M.Id where $sort_column ".($sort_order=='asc'?'>=':'<=')." '".$event[preg_replace( '/^.*\./', '', $sort_column )]."'$filter_sql$mid_sql order by $sort_column $sort_order"; +$sql = "select E.* from Events as E inner join Monitors as M on E.MonitorId = M.Id where $sort_column ".($sort_order=='asc'?'>=':'<=')." '".$event[preg_replace( '/^.*\./', '', $sort_column )]."'".$filter['sql'].$mid_sql." order by $sort_column $sort_order limit 100"; $result = dbQuery( $sql ); while ( $row = dbFetchNext( $result ) ) { @@ -208,7 +208,7 @@ if ( $mode == "stream" ) - + @@ -234,7 +234,7 @@ Learn Pref:  - + @@ -249,24 +249,24 @@ Learn Pref: