From 0e34bade9cc2fa831f9c8a344b2ebfdf4047848c Mon Sep 17 00:00:00 2001
From: Till Brehm <tbrehm@ispconfig.org>
Date: Mon, 27 Oct 2014 08:53:37 -0400
Subject: [PATCH] Fixed: FS#3718 - SQL injection checker false positive alert in APS installer
---
interface/web/admin/server_php_edit.php | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/interface/web/admin/server_php_edit.php b/interface/web/admin/server_php_edit.php
index e88575e..f60ae99 100644
--- a/interface/web/admin/server_php_edit.php
+++ b/interface/web/admin/server_php_edit.php
@@ -43,6 +43,7 @@
//* Check permissions for module
$app->auth->check_module_permissions('admin');
+$app->auth->check_security_permissions('admin_allow_server_php');
// Loading classes
$app->uses('tpl,tform,tform_actions');
@@ -56,7 +57,7 @@
//* Check if the server has been changed
// We do this only for the admin or reseller users, as normal clients can not change the server ID anyway
if(($_SESSION["s"]["user"]["typ"] == 'admin' || $app->auth->has_clients($_SESSION['s']['user']['userid'])) && isset($this->dataRecord["server_id"])) {
- $rec = $app->db->queryOneRecord("SELECT server_id from server_php WHERE server_php_id = ".$this->id);
+ $rec = $app->db->queryOneRecord("SELECT server_id from server_php WHERE server_php_id = ".$app->functions->intval($this->id));
if($rec['server_id'] != $this->dataRecord["server_id"]) {
//* Add a error message and switch back to old server
$app->tform->errorMessage .= $app->lng('The Server can not be changed.');
--
Gitblit v1.9.1