[otrs-cvs] ITSMConfigurationManagement/Kernel/System/ITSMConfigItem Number.pm, 1.4, 1.4.6.1 Version.pm, 1.30, 1.30.2.1

Comments:
Update of /home/cvs/ITSMConfigurationManagement/Kernel/System/ITSMConfigItem
In directory lancelot:/tmp/cvs-serv21507/Kernel/System/ITSMConfigItem

Modified Files:
      Tag: rel-3_0
	Number.pm Version.pm 
Log Message:
Fixed bug# 9547 - XSS and SQL injection vulnerability in module AgentITSMConfigItemSearch on parameter ClassID.

Author: ub

Index: Number.pm
===================================================================
RCS file: /home/cvs/ITSMConfigurationManagement/Kernel/System/ITSMConfigItem/Number.pm,v
retrieving revision 1.4
retrieving revision 1.4.6.1
diff -2 -u -d -r1.4 -r1.4.6.1
--- Number.pm	19 Aug 2009 22:48:14 -0000	1.4
+++ Number.pm	28 Jun 2013 11:14:51 -0000	1.4.6.1
@@ -1,5 +1,5 @@
 # --
 # Kernel/System/ITSMConfigItem/Number.pm - sub module of ITSMConfigItem.pm with number functions
-# Copyright (C) 2001-2009 OTRS AG, http://otrs.org/
+# Copyright (C) 2001-2013 OTRS AG, http://otrs.org/
 # --
 # $Id$
@@ -90,7 +90,4 @@
         if $Self->{Cache}->{ConfigItemNumberLookup}->{Number}->{ $Param{ConfigItemNumber} };
 
-    # quote
-    $Param{ConfigItemNumber} = $Self->{DBObject}->Quote( $Param{ConfigItemNumber} );
-
     # ask database
     $Self->{DBObject}->Prepare(
@@ -250,5 +247,5 @@
 This software comes with ABSOLUTELY NO WARRANTY. For details, see
 the enclosed file COPYING for license information (AGPL). If you
-did not receive this file, see http://www.gnu.org/licenses/agpl.txt.
+did not receive this file, see L<http://www.gnu.org/licenses/agpl.txt>.
 
 =cut

Author: ub

Index: Version.pm
===================================================================
RCS file: /home/cvs/ITSMConfigurationManagement/Kernel/System/ITSMConfigItem/Version.pm,v
retrieving revision 1.30
retrieving revision 1.30.2.1
diff -2 -u -d -r1.30 -r1.30.2.1
--- Version.pm	3 Nov 2011 09:07:05 -0000	1.30
+++ Version.pm	28 Jun 2013 11:14:51 -0000	1.30.2.1
@@ -1,5 +1,5 @@
 # --
 # Kernel/System/ITSMConfigItem/Version.pm - sub module of ITSMConfigItem.pm with version functions
-# Copyright (C) 2001-2011 OTRS AG, http://otrs.org/
+# Copyright (C) 2001-2013 OTRS AG, http://otrs.org/
 # --
 # $Id$
@@ -929,7 +929,7 @@
         next ARRAYPARAM if !@{ $Param{$ArrayParam} };
 
-        # quote
+        # quote as integer
         for my $OneParam ( @{ $Param{$ArrayParam} } ) {
-            $OneParam = $Self->{DBObject}->Quote($OneParam);
+            $OneParam = $Self->{DBObject}->Quote( $OneParam, 'Integer' );
         }
 
@@ -948,5 +948,5 @@
     my $WhereString = @SQLWhere ? ' WHERE ' . join q{ AND }, @SQLWhere : '';
 
-    # set limit
+    # set limit, quote as integer
     if ( $Param{Limit} ) {
         $Param{Limit} = $Self->{DBObject}->Quote( $Param{Limit}, 'Integer' );
---------------------------------------------------------------------
OTRS mailing list: cvs-log - Webpage: http://otrs.org/
Archive: http://lists.otrs.org/pipermail/cvs-log
To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/cvs-log