From: niekt0 <niekt0@kyberia.cz>
Date: Thu, 13 Jan 2011 13:33:37 +0000 (+0100)
Subject: Security fix (sqli)
X-Git-Url: https://git.harvie.cz/?a=commitdiff_plain;h=4cea789e34d85461c00f05824d27b2aa44ce85e5;p=mirrors%2FKyberia-bloodline.git

Security fix (sqli)
---

diff --git a/wwwroot/inc/eventz/configure_bookmarks.inc b/trash/configure_bookmarks.inc
similarity index 100%
rename from wwwroot/inc/eventz/configure_bookmarks.inc
rename to trash/configure_bookmarks.inc
diff --git a/wwwroot/inc/eventz/configure_parent.inc b/trash/configure_parent.inc
similarity index 100%
rename from wwwroot/inc/eventz/configure_parent.inc
rename to trash/configure_parent.inc
diff --git a/wwwroot/inc/eventz/banlist.inc b/wwwroot/inc/eventz/banlist.inc
index b806cb1..3f08d4d 100644
--- a/wwwroot/inc/eventz/banlist.inc
+++ b/wwwroot/inc/eventz/banlist.inc
@@ -8,7 +8,8 @@ if ($node['node_permission']!=('owner' || 'master' || 'op')) {
 $error=$error_messages['EVENT_PERMISSION_ERROR'];
 return false;
 }
-		$bans=explode(";",$_POST['bans']); // XXX sqli?
+		$bans = explode(";",$_POST['bans']); // XXX sqli?
+		$bans = array_map('mysql_real_escape_string', $bans); 
 
 		$db->query("update node_access set node_permission='' where node_id=$node_id and node_permission='ban'");
 		foreach ($bans as $ban) {