[otrs-cvs] ITSMConfigurationManagement/Kernel/System ITSMConfigItem.pm, 1.34, 1.34.2.1

Comments:
Update of /home/cvs/ITSMConfigurationManagement/Kernel/System
In directory lancelot:/tmp/cvs-serv21507/Kernel/System

Modified Files:
      Tag: rel-3_0
	ITSMConfigItem.pm 
Log Message:
Fixed bug# 9547 - XSS and SQL injection vulnerability in module AgentITSMConfigItemSearch on parameter ClassID.

Author: ub

Index: ITSMConfigItem.pm
===================================================================
RCS file: /home/cvs/ITSMConfigurationManagement/Kernel/System/ITSMConfigItem.pm,v
retrieving revision 1.34
retrieving revision 1.34.2.1
diff -2 -u -d -r1.34 -r1.34.2.1
--- ITSMConfigItem.pm	7 Nov 2011 11:22:25 -0000	1.34
+++ ITSMConfigItem.pm	28 Jun 2013 11:14:52 -0000	1.34.2.1
@@ -1,5 +1,5 @@
 # --
 # Kernel/System/ITSMConfigItem.pm - all config item function
-# Copyright (C) 2001-2011 OTRS AG, http://otrs.org/
+# Copyright (C) 2001-2013 OTRS AG, http://otrs.org/
 # --
 # $Id$
@@ -923,7 +923,7 @@
         next ARRAYPARAM if !@{ $Param{$ArrayParam} };
 
-        # quote
+        # quote as integer
         for my $OneParam ( @{ $Param{$ArrayParam} } ) {
-            $OneParam = $Self->{DBObject}->Quote($OneParam);
+            $OneParam = $Self->{DBObject}->Quote( $OneParam, 'Integer' );
         }
 
@@ -1316,5 +1316,5 @@
         next CONFIGITEMID
             if $Param{ScannedConfigItemIDs}->{$ConfigItemID}->{Type}
-                && $Param{ScannedConfigItemIDs}->{$ConfigItemID}->{Type} eq 'incident';
+            && $Param{ScannedConfigItemIDs}->{$ConfigItemID}->{Type} eq 'incident';
 
         # set warning state
---------------------------------------------------------------------
OTRS mailing list: cvs-log - Webpage: http://otrs.org/
Archive: http://lists.otrs.org/pipermail/cvs-log
To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/cvs-log