Design/EasySoft-ZenTaoPMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 30 Wiki Activity

* [refac] fix sql injection vulnerability.

Browse Source
This commit is contained in:
liugang
2024-08-26 14:50:22 +08:00
committed by 王怡栋
parent fb4bbe58a6
commit 60bd0dd9ca
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
module/my/control.php
+8 -1
View File
@@ -1418,7 +1418,14 @@ class my extends control
if($_POST)
{
foreach($_POST as $key => $value) $this->setting->setItem("{$this->app->user->account}.common.$key", $value);
$keyList = array('URSR', 'programLink', 'productLink', 'projectLink', 'executionLink');
foreach($_POST as $key => $value)
{
if(!in_array($key, $keyList)) continue;
if($key != 'URSR' && !isset($this->lang->my->{$key . 'List'}[$value])) continue;
if($key == 'URSR') $value = (int)$value;
$this->setting->setItem("{$this->app->user->account}.common.$key", $value);
}
$this->setting->setItem("{$this->app->user->account}.common.preferenceSetted", 1);