[otrs-cvs] ITSMConfigurationManagement/Kernel/Modules AgentITSMConfigItemSearch.pm, 1.36, 1.37

Comments:
Update of /home/cvs/ITSMConfigurationManagement/Kernel/Modules
In directory lancelot:/tmp/cvs-serv23588/Kernel/Modules

Modified Files:
	AgentITSMConfigItemSearch.pm 
Log Message:
Fixed bug# 9547 - XSS and SQL injection vulnerability in module AgentITSMConfigItemSearch on parameter ClassID.

Author: ub

Index: AgentITSMConfigItemSearch.pm
===================================================================
RCS file: /home/cvs/ITSMConfigurationManagement/Kernel/Modules/AgentITSMConfigItemSearch.pm,v
retrieving revision 1.36
retrieving revision 1.37
diff -2 -u -d -r1.36 -r1.37
--- AgentITSMConfigItemSearch.pm	24 Apr 2013 03:33:07 -0000	1.36
+++ AgentITSMConfigItemSearch.pm	28 Jun 2013 11:22:32 -0000	1.37
@@ -86,4 +86,12 @@
     my $ClassID = $Self->{ParamObject}->GetParam( Param => 'ClassID' );
 
+    # check if class id is valid
+    if ( $ClassID && !$ClassList->{$ClassID} ) {
+        return $Self->{LayoutObject}->ErrorScreen(
+            Message => 'Invalid ClassID!',
+            Comment => 'Please contact the admin.',
+        );
+    }
+
     # get single params
     my %GetParam;
---------------------------------------------------------------------
OTRS mailing list: cvs-log - Webpage: http://otrs.org/
Archive: http://lists.otrs.org/pipermail/cvs-log
To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/cvs-log