L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-28360 Fix for sql injection vulnerability in flat file enrollment - Matt Meisberger (WebCourseworks)

Browse Source
This commit is contained in:
Matt Meisberger
2011-07-20 15:52:22 +02:00
committed by Petr Skoda
parent 6bbf934a3e
commit bd4f3fa5c4
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
enrol/flatfile/enrol.php
+2 -2
View File
@@ -157,13 +157,13 @@ function get_access_icons($course) {
continue;
}
if (! $user = get_record("user", "idnumber", $fields[2]) ) {
if (! $user = get_record("user", "idnumber", addslashes($fields[2])) ) {
$this->log .= "Unknown user idnumber in field 3 - ignoring line\n";
continue;
}
if (! $course = get_record("course", "idnumber", $fields[3]) ) {
if (! $course = get_record("course", "idnumber", addslashes($fields[3])) ) {
$this->log .= "Unknown course idnumber in field 4 - ignoring line\n";
continue;
}