Attach Documents: fixed SQL injection vulnerability.

diff --git a/admin/db/transactions_db.inc b/admin/db/transactions_db.inc
index d343b7c4ba8522119d1e93688bd73101ff4d4244..f7d2d295ec6ff7177c44799ac7c63f56c3dd4c31 100644 (file)
--- a/admin/db/transactions_db.inc
+++ b/admin/db/transactions_db.inc
@@ -35,7 +35,7 @@ function get_sql_for_view_transactions($filtertype, $from, $to, &$trans_ref)
        if ($type_name)
                $sql .= ", t.$type_name as type";
        $sql .= " FROM $table_name t LEFT JOIN ".TB_PREF."voided v ON"
-               ." t.$trans_no_name=v.id AND v.type=$filtertype";
+               ." t.$trans_no_name=v.id AND v.type=".db_escape($filtertype);
 
        $sql .= " WHERE ISNULL(v.`memo_`)";
        if ($from != null && $to != null)

diff --git a/includes/references.inc b/includes/references.inc
index 7a919f27d43720094bf9ac746d90d74ad9e9ed46..526dc1553cdb0cfa8b392e64228aef66d5781d7e 100644 (file)
--- a/includes/references.inc
+++ b/includes/references.inc
@@ -165,6 +165,7 @@ class references
                $type_fld = $db_info[1];
                $tno_fld = $db_info[2];
                $ref_fld = $db_info[3];
+               $type = db_escape($type);
 
                // retrieve last ref number in the refline from original transaction table
                $sql = "SELECT MAX(CAST(SUBSTR($ref_fld, ".(strlen($prefix)+1).",LENGTH($ref_fld)-".(strlen($postfix)+strlen($prefix)).") AS UNSIGNED))"