copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Strengthen SQL injection safeguards across objects and traits, add input validation and sanitization, and refine query efficiency with deduplication and null checks.

Browse Source
This commit is contained in:
Jeppe Bundgaard
2026-03-12 20:36:08 +01:00
parent a5963da4e6
commit 1190290899
5 changed files with 119 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/traits/module_config_t.php
+5 -8
View File
@@ -43,11 +43,6 @@ trait module_config_t
// Get the variable name and value
$variable = $response->getRequestParameter('variable');
$value = $response->getRequestParameter('value');
// Sanitize the variable name and value
global /** @var db $db */
$db;
$variable = $db->escape_string($variable);
$value = $db->escape_string($value);
// Check if the variable is allowed to be updated
if (!self::isVariableAllowed($variable)) {
// Return an error message, telling the user that the variable is not allowed to be updated. With a list of allowed variables
@@ -106,8 +101,9 @@ trait module_config_t
$variable = $_GET['variable'];
// Sanitize the variable name
$variable = $db->escape_string($variable);
$module = $db->escape_string($this->module_name);
// Get the config variable
$sql = "SELECT * FROM module_config WHERE module = '$this->module_name' AND variable = '$variable'";
$sql = "SELECT * FROM module_config WHERE module = '$module' AND variable = '$variable'";
return $this->extracted($db, $sql);
}
@@ -118,7 +114,8 @@ trait module_config_t
function getConfig(): array
{
global $db;
$sql = "SELECT * FROM module_config WHERE module = '$this->module_name'";
$module = $db->escape_string($this->module_name);
$sql = "SELECT * FROM module_config WHERE module = '$module'";
return $this->extracted($db, $sql);
}
@@ -196,4 +193,4 @@ trait module_config_t
{
return $this->module_name;
}
}
}