Skip to content

Commit

Permalink
Security fix
Browse files Browse the repository at this point in the history
  • Loading branch information
@scoumbourdis
scoumbourdis committed Nov 8, 2018
1 parent 1f10265 commit 2b580e0
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 1 deletion.
4 changes: 3 additions & 1 deletion application/libraries/Grocery_CRUD.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3240,12 +3240,14 @@ public function getStateInfo()
if (is_array($data['search_field'])) {
$search_array = array();
foreach ($data['search_field'] as $search_key => $search_field_name) {
$search_field_name = preg_replace('/[^a-zA-Z0-9_]/', '' , $search_field_name);
$search_array[$search_field_name] = isset($data['search_text'][$search_key]) ? $data['search_text'][$search_key] : '';
}
$state_info->search = $search_array;
} else {
$field_name = preg_replace('/[^a-zA-Z0-9_]/', '' , $data['search_field']);
$state_info->search = (object)array(
'field' => strip_tags($data['search_field']) ,
'field' => $field_name,
'text' => $data['search_text'] );
}
}
Expand Down
1 change: 1 addition & 0 deletions change_log.txt
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
v 1.6.2
- #442: Searching in grid with value 0 is not working
- #458: Updated Lithuanian language by @dgvirtual
- Security fix

This comment has been minimized.

Sign in to view

Copy link
@mckaygerhard

mckaygerhard Dec 12, 2018

this changelog are very ambigous! must be documented that due security field names only could be in latin words.. nott cirilic or toher! do you know that some programmers could do that?

This comment has been minimized.

Sign in to view

Copy link
@scoumbourdis

scoumbourdis Dec 24, 2018

Author Owner

Hello @mckaygerhard this was not the purpose of that to be honest. This was a fast work-around in order to prevent SQL injection. I was thinking to change it to something like this:

"[="'?\\]"

so to replace only the characters that can cause SQL injections (e.g. chars like '"?... e.t.c.). I will do the commit and keep it as a note here.

Regards
Johnny

This comment has been minimized.

Sign in to view

Copy link
@mckaygerhard

mckaygerhard Dec 24, 2018

i miscunderstand the commit due i alwas on hurry, short time, too much work, does not allow me to stop much today, i have now i problem with image previews.. search at the ancinet commits but i not found how to revert image previews without making a callback (internet connection are very slow to show image previews, seems grocerycrud use same image stored to preview.. event a minimized compresed/reduced)

This comment has been minimized.

Sign in to view

Copy link
@scoumbourdis

scoumbourdis Dec 24, 2018

Author Owner

You can easily do that by changing the line 349 here: https://github.com/scoumbourdis/grocery-crud/blob/master/application/libraries/Grocery_CRUD.php#L349

More specifically change the line:
$file_url_anchor .= ' class="image-thumbnail"><img src="'.$file_url.'" height="50px">';
with:
$file_url_anchor .= ' class="image-thumbnail">' . $value;

and the line 2787: https://github.com/scoumbourdis/grocery-crud/blob/master/application/libraries/Grocery_CRUD.php#L2787

change the:
$input .= $is_image ? " $image_class'><img src='".$file_url."' height='50px'>" : "' target='_blank'>$value"; with:

$input .= "' target='_blank'>$value";

This comment has been minimized.

Sign in to view

Copy link
@mckaygerhard

mckaygerhard Dec 24, 2018

i'll post in the respective issue thanks.. after doing i'll post details how to doit
v 1.6.1
- #441: Adding clone functionality - contribution from @portapipe
v 1.6.0
Expand Down

1 comment on commit 2b580e0

@scoumbourdis
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The issue with the security fix to take any name is fixed now on: e1d97de

Please sign in to comment.