L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-18040 rewritten XSS query, I hope this will be much faster; backported from HEAD

Browse Source
This commit is contained in:
skodak
2009-01-28 22:51:28 +00:00
parent 5893fbd8e1
commit b3b4937eb6
1 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/report/security/lib.php
+10 -9
View File
@@ -482,15 +482,16 @@ function report_security_check_riskxss($detailed=false) {
$result->status = REPORT_SECURITY_WARNING;
$result->link = null;
$sqlfrom = "FROM {$CFG->prefix}role_capabilities rc
JOIN {$CFG->prefix}capabilities cap ON cap.name = rc.capability
JOIN {$CFG->prefix}context c ON c.id = rc.contextid
JOIN {$CFG->prefix}context sc ON (sc.path = c.path OR sc.path LIKE ".sql_concat('c.path', "'/%'")." OR c.path LIKE ".sql_concat('sc.path', "'/%'").")
JOIN {$CFG->prefix}role_assignments ra ON (ra.contextid = sc.id AND ra.roleid = rc.roleid)
JOIN {$CFG->prefix}user u ON u.id = ra.userid
WHERE ".sql_bitand('cap.riskbitmask', RISK_XSS)." <> 0
AND rc.permission = ".CAP_ALLOW."
AND u.deleted = 0";
$sqlfrom = "FROM (SELECT rcx.* FROM {$CFG->prefix}role_capabilities rcx JOIN {$CFG->prefix}capabilities cap ON (cap.name = rcx.capability AND ".sql_bitand('cap.riskbitmask', RISK_XSS)." <> 0))rc,
{$CFG->prefix}context c,
{$CFG->prefix}context sc,
{$CFG->prefix}role_assignments ra,
{$CFG->prefix}user u
WHERE c.id = rc.contextid
AND (sc.path = c.path OR sc.path LIKE ".sql_concat('c.path', "'/%'")." OR c.path LIKE ".sql_concat('sc.path', "'/%'").")
AND u.id = ra.userid
AND ra.contextid = sc.id AND ra.roleid = rc.roleid
AND rc.permission = ".CAP_ALLOW." AND u.deleted = 0";
$count = count_records_sql("SELECT COUNT(DISTINCT u.id) $sqlfrom");