#4777: Fixed SQL Injection on admin. Added addslashes to $_POST student_id and email.

diff --git a/docs/mods/_core/users/create_user.php b/docs/mods/_core/users/create_user.php
index 94e48e4..51ff757 100644 (file)
--- a/docs/mods/_core/users/create_user.php
+++ b/docs/mods/_core/users/create_user.php
@@ -23,6 +23,22 @@ if (isset($_POST['cancel'])) {
 \r
 if (isset($_POST['submit'])) {\r
        $missing_fields = array();\r
+        $_POST['password']   = $addslashes($_POST['password']);\r
+               $_POST['website']    = $addslashes($_POST['website']);\r
+               $_POST['first_name'] = $addslashes($_POST['first_name']);\r
+               $_POST['second_name']  = $addslashes($_POST['second_name']);\r
+               $_POST['last_name']  = $addslashes($_POST['last_name']);\r
+               $_POST['address']    = $addslashes($_POST['address']);\r
+               $_POST['postal']     = $addslashes($_POST['postal']);\r
+               $_POST['city']       = $addslashes($_POST['city']);\r
+               $_POST['province']   = $addslashes($_POST['province']);\r
+               $_POST['country']    = $addslashes($_POST['country']);\r
+               $_POST['phone']      = $addslashes($_POST['phone']);\r
+               $_POST['status']     = intval($_POST['status']);\r
+               $_POST['gender']     = $addslashes($_POST['gender']);\r
+               $_POST['login']      = $addslashes($_POST['login']);\r
+        $_POST['email'] = $addslashes($_POST['email']);\r
+\r
 \r
        //check if student id (public field) is already being used\r
        if (!$_POST['overwrite'] && !empty($_POST['student_id'])) {\r
@@ -77,7 +93,6 @@ if (isset($_POST['submit'])) {
                $msg->addError('EMAIL_INVALID');\r
        }\r
 \r
-       $_POST['email'] = $addslashes($_POST['email']);\r
        $result = mysql_query("SELECT member_id FROM ".TABLE_PREFIX."members WHERE email LIKE '$_POST[email]'",$db);\r
        if (mysql_num_rows($result) != 0) {\r
                $msg->addError('EMAIL_EXISTS');\r
@@ -137,19 +152,6 @@ if (isset($_POST['submit'])) {
                } else {\r
                        $_POST['private_email'] = 0;\r
                }\r
-               $_POST['password']   = $addslashes($_POST['password']);\r
-               $_POST['website']    = $addslashes($_POST['website']);\r
-               $_POST['first_name'] = $addslashes($_POST['first_name']);\r
-               $_POST['second_name']  = $addslashes($_POST['second_name']);\r
-               $_POST['last_name']  = $addslashes($_POST['last_name']);\r
-               $_POST['address']    = $addslashes($_POST['address']);\r
-               $_POST['postal']     = $addslashes($_POST['postal']);\r
-               $_POST['city']       = $addslashes($_POST['city']);\r
-               $_POST['province']   = $addslashes($_POST['province']);\r
-               $_POST['country']    = $addslashes($_POST['country']);\r
-               $_POST['phone']      = $addslashes($_POST['phone']);\r
-               $_POST['status']     = intval($_POST['status']);\r
-               $_POST['gender']     = $addslashes($_POST['gender']);\r
 \r
                $now = date('Y-m-d H:i:s'); // we use this later for the email confirmation.\r
 \r
@@ -232,4 +234,4 @@ if (!isset($_POST['status'])) {
 \r
 $savant->display('registration.tmpl.php');\r
 \r
-?>
\ No newline at end of file
+?>\r

diff --git a/docs/mods/_core/users/edit_user.php b/docs/mods/_core/users/edit_user.php
index b7123bd..7fdea95 100644 (file)
--- a/docs/mods/_core/users/edit_user.php
+++ b/docs/mods/_core/users/edit_user.php
@@ -29,6 +29,22 @@ if (isset($_POST['submit'])) {
        $missing_fields = array();\r
 \r
        $id = intval($_POST['id']);\r
+       //$_POST['password']   = $addslashes($_POST['password']);\r
+    $_POST['website']    = $addslashes($_POST['website']);\r
+    $_POST['first_name'] = $addslashes($_POST['first_name']);\r
+    $_POST['second_name'] = $addslashes($_POST['second_name']);\r
+    $_POST['last_name']  = $addslashes($_POST['last_name']);\r
+    $_POST['address']    = $addslashes($_POST['address']);\r
+    $_POST['postal']     = $addslashes($_POST['postal']);\r
+    $_POST['city']       = $addslashes($_POST['city']);\r
+    $_POST['province']   = $addslashes($_POST['province']);\r
+    $_POST['country']    = $addslashes($_POST['country']);\r
+    $_POST['phone']      = $addslashes($_POST['phone']);\r
+    $_POST['status']     = intval($_POST['status']);\r
+    $_POST['old_status']     = intval($_POST['old_status']);\r
+    $_POST['gender']     = $addslashes($_POST['gender']);\r
+    $_POST['student_id'] = intval($_POST['student_id']);\r
+    $_POST['email']      = $addslashes($_POST['email']);\r
 \r
        //check if student id (public field) is already being used\r
        if (!$_POST['overwrite'] && !empty($_POST['student_id'])) {\r
@@ -125,21 +141,6 @@ if (isset($_POST['submit'])) {
                        $_POST['private_email'] = 0;\r
                }\r
 \r
-               //$_POST['password']   = $addslashes($_POST['password']);\r
-               $_POST['website']    = $addslashes($_POST['website']);\r
-               $_POST['first_name'] = $addslashes($_POST['first_name']);\r
-               $_POST['second_name'] = $addslashes($_POST['second_name']);\r
-               $_POST['last_name']  = $addslashes($_POST['last_name']);\r
-               $_POST['address']    = $addslashes($_POST['address']);\r
-               $_POST['postal']     = $addslashes($_POST['postal']);\r
-               $_POST['city']       = $addslashes($_POST['city']);\r
-               $_POST['province']   = $addslashes($_POST['province']);\r
-               $_POST['country']    = $addslashes($_POST['country']);\r
-               $_POST['phone']      = $addslashes($_POST['phone']);\r
-               $_POST['status']     = intval($_POST['status']);\r
-               $_POST['old_status']     = intval($_POST['old_status']);\r
-               $_POST['gender']     = $addslashes($_POST['gender']);\r
-\r
                /* insert into the db. (the last 0 for status) */\r
                $sql = "UPDATE ".TABLE_PREFIX."members SET      email      = '$_POST[email]',\r
                                                                                                        website    = '$_POST[website]',\r
@@ -261,4 +262,4 @@ if (isset($_REQUEST['ml']) && $_REQUEST['ml']) {
 $savant->assign('no_captcha', true);\r
 $savant->display('registration.tmpl.php');\r
 \r
-?>
\ No newline at end of file
+?>\r