Skip to content

Commit

Permalink
Code cleanup and fix possible injections when a trusted user is logge…
Browse files Browse the repository at this point in the history 
…d in thanks to mwdmeyer, constant_chaos, disclosure5 and rightwayround from /r/msp for pointing these issues out
  • Loading branch information
@johnnyq
johnnyq committed Dec 12, 2021
1 parent 82ead8a commit faf39fc
Show file tree
Hide file tree
Showing 17 changed files with 33 additions and 40 deletions.
4 changes: 2 additions & 2 deletions alerts_archived.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,8 +41,8 @@

//Date From and Date To Filter
if(!empty($_GET['dtf'])){
$dtf = $_GET['dtf'];
$dtt = $_GET['dtt'];
$dtf = mysqli_real_escape_string($mysqli,$_GET['dtf']);
$dtt = mysqli_real_escape_string($mysqli,$_GET['dtt']);
}else{
$dtf = "0000-00-00";
$dtt = "9999-00-00";
Expand Down
4 changes: 2 additions & 2 deletions assets.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,8 +41,8 @@

//Date From and Date To Filter
if(!empty($_GET['dtf'])){
$dtf = $_GET['dtf'];
$dtt = $_GET['dtt'];
$dtf = mysqli_real_escape_string($mysqli,$_GET['dtf']);
$dtt = mysqli_real_escape_string($mysqli,$_GET['dtt']);
}else{
$dtf = "0000-00-00";
$dtt = "9999-00-00";
Expand Down
4 changes: 2 additions & 2 deletions campaigns.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,8 @@

//Date Filter
if($_GET['canned_date'] == "custom" AND !empty($_GET['dtf'])){
$dtf = $_GET['dtf'];
$dtt = $_GET['dtt'];
$dtf = mysqli_real_escape_string($mysqli,$_GET['dtf']);
$dtt = mysqli_real_escape_string($mysqli,$_GET['dtt']);
}elseif($_GET['canned_date'] == "today"){
$dtf = date('Y-m-d');
$dtt = date('Y-m-d');
Expand Down
4 changes: 2 additions & 2 deletions client_trips.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,8 @@

//Date From and Date To Filter
if(isset($_GET['dtf'])){
$dtf = $_GET['dtf'];
$dtt = $_GET['dtt'];
$dtf = mysqli_real_escape_string($mysqli,$_GET['dtf']);
$dtt = mysqli_real_escape_string($mysqli,$_GET['dtt']);
}else{
$dtf = "0000-00-00";
$dtt = "9999-00-00";
Expand Down
4 changes: 2 additions & 2 deletions clients.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -48,8 +48,8 @@

//Date Filter
if($_GET['canned_date'] == "custom" AND !empty($_GET['date_from'])){
$date_from = $_GET['date_from'];
$date_to = $_GET['date_to'];
$date_from = mysqli_real_escape_string($mysqli,$_GET['date_from']);
$date_to = mysqli_real_escape_string($mysqli,$_GET['date_to']);
}elseif($_GET['canned_date'] == "today"){
$date_from = date('Y-m-d');
$date_to = date('Y-m-d');
Expand Down
4 changes: 2 additions & 2 deletions expenses.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,8 @@

//Date Filter
if($_GET['canned_date'] == "custom" AND !empty($_GET['dtf'])){
$dtf = $_GET['dtf'];
$dtt = $_GET['dtt'];
$dtf = mysqli_real_escape_string($mysqli,$_GET['dtf']);
$dtt = mysqli_real_escape_string($mysqli,$_GET['dtt']);
}elseif($_GET['canned_date'] == "today"){
$dtf = date('Y-m-d');
$dtt = date('Y-m-d');
Expand Down
9 changes: 1 addition & 8 deletions index.php
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
<?php include("header.php"); ?>
<?php $os = get_ip(); ?>
<!-- Breadcrumbs-->
<ol class="breadcrumb">
<li class="breadcrumb-item">
Expand All @@ -11,10 +10,4 @@
<!-- Page Content -->
<h1>Blank Page</h1>
<hr>
<p><?php echo get_user_agent(); ?></p>
<p><?php echo get_ip(); ?></p>
<p><?php echo get_os(); ?></p>
<p><?php echo get_web_browser(); ?></p>
<p><?php echo get_device(); ?></p>

<?php include("footer.php"); ?>
<?php include("footer.php"); ?>
4 changes: 2 additions & 2 deletions invoices.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -89,8 +89,8 @@

//Date Filter
if($_GET['canned_date'] == "custom" AND !empty($_GET['dtf'])){
$dtf = $_GET['dtf'];
$dtt = $_GET['dtt'];
$dtf = mysqli_real_escape_string($mysqli,$_GET['dtf']);
$dtt = mysqli_real_escape_string($mysqli,$_GET['dtt']);
}elseif($_GET['canned_date'] == "today"){
$dtf = date('Y-m-d');
$dtt = date('Y-m-d');
Expand Down
4 changes: 2 additions & 2 deletions logs.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,8 @@

//Date Filter
if($_GET['canned_date'] == "custom" AND !empty($_GET['dtf'])){
$dtf = $_GET['dtf'];
$dtt = $_GET['dtt'];
$dtf = mysqli_real_escape_string($mysqli,$_GET['dtf']);
$dtt = mysqli_real_escape_string($mysqli,$_GET['dtt']);
}elseif($_GET['canned_date'] == "today"){
$dtf = date('Y-m-d');
$dtt = date('Y-m-d');
Expand Down
4 changes: 2 additions & 2 deletions payments.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,8 @@

//Date Filter
if($_GET['canned_date'] == "custom" AND !empty($_GET['dtf'])){
$dtf = $_GET['dtf'];
$dtt = $_GET['dtt'];
$dtf = mysqli_real_escape_string($mysqli,$_GET['dtf']);
$dtt = mysqli_real_escape_string($mysqli,$_GET['dtt']);
}elseif($_GET['canned_date'] == "today"){
$dtf = date('Y-m-d');
$dtt = date('Y-m-d');
Expand Down
4 changes: 2 additions & 2 deletions quotes.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -40,8 +40,8 @@

//Date Filter
if($_GET['canned_date'] == "custom" AND !empty($_GET['dtf'])){
$dtf = $_GET['dtf'];
$dtt = $_GET['dtt'];
$dtf = mysqli_real_escape_string($mysqli,$_GET['dtf']);
$dtt = mysqli_real_escape_string($mysqli,$_GET['dtt']);
}elseif($_GET['canned_date'] == "today"){
$dtf = date('Y-m-d');
$dtt = date('Y-m-d');
Expand Down
4 changes: 2 additions & 2 deletions recurring.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,8 @@

//Date Filter
if($_GET['canned_date'] == "custom" AND !empty($_GET['dtf'])){
$dtf = $_GET['dtf'];
$dtt = $_GET['dtt'];
$dtf = mysqli_real_escape_string($mysqli,$_GET['dtf']);
$dtt = mysqli_real_escape_string($mysqli,$_GET['dtt']);
}elseif($_GET['canned_date'] == "today"){
$dtf = date('Y-m-d');
$dtt = date('Y-m-d');
Expand Down
4 changes: 2 additions & 2 deletions revenues.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,8 @@

//Date Filter
if($_GET['canned_date'] == "custom" AND !empty($_GET['dtf'])){
$dtf = $_GET['dtf'];
$dtt = $_GET['dtt'];
$dtf = mysqli_real_escape_string($mysqli,$_GET['dtf']);
$dtt = mysqli_real_escape_string($mysqli,$_GET['dtt']);
}elseif($_GET['canned_date'] == "today"){
$dtf = date('Y-m-d');
$dtt = date('Y-m-d');
Expand Down
4 changes: 2 additions & 2 deletions tickets.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,8 @@

//Date Filter
if($_GET['canned_date'] == "custom" AND !empty($_GET['dtf'])){
$dtf = $_GET['dtf'];
$dtt = $_GET['dtt'];
$dtf = mysqli_real_escape_string($mysqli,$_GET['dtf']);
$dtt = mysqli_real_escape_string($mysqli,$_GET['dtt']);
}elseif($_GET['canned_date'] == "today"){
$dtf = date('Y-m-d');
$dtt = date('Y-m-d');
Expand Down
4 changes: 2 additions & 2 deletions transfers.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,8 +41,8 @@

//Date Filter
if($_GET['canned_date'] == "custom" AND !empty($_GET['dtf'])){
$dtf = $_GET['dtf'];
$dtt = $_GET['dtt'];
$dtf = mysqli_real_escape_string($mysqli,$_GET['dtf']);
$dtt = mysqli_real_escape_string($mysqli,$_GET['dtt']);
}elseif($_GET['canned_date'] == "today"){
$dtf = date('Y-m-d');
$dtt = date('Y-m-d');
Expand Down
4 changes: 2 additions & 2 deletions trips.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,8 @@

//Date Filter
if($_GET['canned_date'] == "custom" AND !empty($_GET['dtf'])){
$dtf = $_GET['dtf'];
$dtt = $_GET['dtt'];
$dtf = mysqli_real_escape_string($mysqli,$_GET['dtf']);
$dtt = mysqli_real_escape_string($mysqli,$_GET['dtt']);
}elseif($_GET['canned_date'] == "today"){
$dtf = date('Y-m-d');
$dtt = date('Y-m-d');
Expand Down
4 changes: 2 additions & 2 deletions vendors.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -40,8 +40,8 @@

//Date From and Date To Filter
if(!empty($_GET['dtf'])){
$dtf = $_GET['dtf'];
$dtt = $_GET['dtt'];
$dtf = mysqli_real_escape_string($mysqli,$_GET['dtf']);
$dtt = mysqli_real_escape_string($mysqli,$_GET['dtt']);
}else{
$dtf = "0000-00-00";
$dtt = "9999-00-00";
Expand Down

0 comments on commit faf39fc

Please sign in to comment.