xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-09-04 17:37:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: security patching due to mysql injection vulnerabilities everywhere

Browse Source
This commit is contained in:
Martin Ambrus
2017-10-17 12:21:41 +02:00
parent 74cccb2a74
commit 1654ce498f
10 changed files with 694 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Templates/goldClub/farmlist_addraid.tpl
+1 -1
View File
@@ -120,7 +120,7 @@ $lvname = $database->getVillageField($row["wref"], 'name');
<label class="lastTargets">Last targets:</label>
<select name="target_id">
<?php
$getwref = "SELECT * FROM ".TB_PREFIX."raidlist WHERE lid = ".$_GET['lid']."";
$getwref = "SELECT * FROM ".TB_PREFIX."raidlist WHERE lid = ".$database->escape($_GET['lid'])."";
$arraywref = $database->query_return($getwref);
echo '<option value="">Select village</option>';
if(mysqli_num_rows(mysqli_query($GLOBALS['link'],$getwref)) != 0){
Templates/goldClub/farmlist_editraid.tpl
+1 -1
View File
@@ -79,7 +79,7 @@ if($FLData['owner'] == $session->uid){
<div class="boxes boxesColor gray"><div class="boxes-tl"></div><div class="boxes-tr"></div><div class="boxes-tc"></div><div class="boxes-ml"></div><div class="boxes-mr"></div><div class="boxes-mc"></div><div class="boxes-bl"></div><div class="boxes-br"></div><div class="boxes-bc"></div><div class="boxes-contents cf">
<?php
$getlid = $database->getRaidList($_GET["eid"]);
$getlid = $database->getRaidList($database->escape($_GET["eid"]));
$lid2 = $getlid['lid'];
?>
<input type="hidden" name="action" value="editSlot">