From baf5dda4cc07aa35eb9e41dda90aee0d2cdecf23 Mon Sep 17 00:00:00 2001
From: Sergio Cambra <sergio@programatica.es>
Date: Tue, 08 Jul 2014 09:53:13 -0400
Subject: [PATCH] fix escaping in sql query
---
interface/web/mail/mail_user_edit.php | 12 ++++++------
1 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/interface/web/mail/mail_user_edit.php b/interface/web/mail/mail_user_edit.php
index 75fb42f..a0691f9 100644
--- a/interface/web/mail/mail_user_edit.php
+++ b/interface/web/mail/mail_user_edit.php
@@ -93,7 +93,7 @@
// Get the spamfilter policys for the user
$tmp_user = $app->db->queryOneRecord("SELECT policy_id FROM spamfilter_users WHERE email = '".$app->db->quote($this->dataRecord["email"])."'");
- $sql = "SELECT id, policy_name FROM spamfilter_policy WHERE ".$app->tform->getAuthSQL('r');
+ $sql = "SELECT id, policy_name FROM spamfilter_policy WHERE ".$app->tform->getAuthSQL('r') . " ORDER BY policy_name";
$policys = $app->db->queryAllRecords($sql);
$policy_select = "<option value='0'>".$app->tform->lng("no_policy")."</option>";
if(is_array($policys)) {
@@ -259,7 +259,7 @@
$disableimap = ($this->dataRecord["disableimap"])?'y':'n';
$disablepop3 = ($this->dataRecord["disablepop3"])?'y':'n';
$disabledeliver = ($this->dataRecord["postfix"] == 'y')?'n':'y';
- $disablesmtp = ($this->dataRecord["postfix"] == 'y')?'n':'y';
+ $disablesmtp = ($this->dataRecord["disablesmtp"])?'y':'n';
$sql = "UPDATE mail_user SET disableimap = '$disableimap', disablesieve = '$disableimap', disablepop3 = '$disablepop3', disablesmtp = '$disablesmtp', disabledeliver = '$disabledeliver', disablelda = '$disabledeliver', disabledoveadm = '$disableimap' WHERE mailuser_id = ".$this->id;
$app->db->query($sql);
@@ -300,9 +300,9 @@
$disableimap = (isset($this->dataRecord["disableimap"]) && $this->dataRecord["disableimap"])?'y':'n';
$disablepop3 = (isset($this->dataRecord["disablepop3"]) && $this->dataRecord["disablepop3"])?'y':'n';
$disabledeliver = ($this->dataRecord["postfix"] == 'y')?'n':'y';
- $disablesmtp = ($this->dataRecord["postfix"] == 'y')?'n':'y';
+ $disablesmtp = (isset($this->dataRecord["disablesmtp"]) && $this->dataRecord["disablesmtp"])?'y':'n';
- $sql = "UPDATE mail_user SET disableimap = '$disableimap', disablesieve = '$disableimap', disablepop3 = '$disablepop3', disablesmtp = '$disablesmtp', disabledeliver = '$disabledeliver', disablelda = '$disabledeliver', disabledoveadm = '$disableimap' WHERE mailuser_id = ".$this->id;
+ $sql = "UPDATE mail_user SET disableimap = '$disableimap', disablesieve = '$disableimap', `disablesieve-filter` = '$disableimap', disablepop3 = '$disablepop3', disablesmtp = '$disablesmtp', disabledeliver = '$disabledeliver', disablelda = '$disabledeliver', disabledoveadm = '$disableimap' WHERE mailuser_id = ".$this->id;
$app->db->query($sql);
}
@@ -323,8 +323,8 @@
//* Change backup options when user mail backup options have been changed
if(isset($this->dataRecord['backup_interval']) && ($this->dataRecord['backup_interval'] != $this->oldDataRecord['backup_interval'] || $this->dataRecord['backup_copies'] != $this->oldDataRecord['backup_copies'])) {
- $backup_interval = $this->dataRecord['backup_interval'];
- $backup_copies = $this->dataRecord['backup_copies'];
+ $backup_interval = $app->db->quote($this->dataRecord['backup_interval']);
+ $backup_copies = $app->functions->intval($this->dataRecord['backup_copies']);
$app->db->datalogUpdate('mail_user', "backup_interval = '$backup_interval', backup_copies = '$backup_copies'", 'mailuser_id', $rec['mailuser_id']);
unset($backup_copies);
unset($backup_interval);
--
Gitblit v1.9.1