[otrs-cvs] ITSMChangeManagement/Kernel/System/ITSMChange Template.pm, 1.61, 1.62 ITSMWorkOrder.pm, 1.136, 1.137

Comments:
Update of /home/cvs/ITSMChangeManagement/Kernel/System/ITSMChange
In directory lancelot:/tmp/cvs-serv17012/Kernel/System/ITSMChange

Modified Files:
	Template.pm ITSMWorkOrder.pm 
Log Message:
Improved quoting for integer values to avoid possible security issues.

Author: ub

Index: Template.pm
===================================================================
RCS file: /home/cvs/ITSMChangeManagement/Kernel/System/ITSMChange/Template.pm,v
retrieving revision 1.61
retrieving revision 1.62
diff -2 -u -d -r1.61 -r1.62
--- Template.pm	22 Apr 2013 20:31:34 -0000	1.61
+++ Template.pm	28 Jun 2013 13:02:29 -0000	1.62
@@ -808,7 +808,7 @@
         next ARRAYPARAM if !@{ $Param{$ArrayParam} };
 
-        # quote
+        # quote as integer
         for my $OneParam ( @{ $Param{$ArrayParam} } ) {
-            $OneParam = $Self->{DBObject}->Quote($OneParam);
+            $OneParam = $Self->{DBObject}->Quote( $OneParam, 'Integer' );
         }
 

Author: ub

Index: ITSMWorkOrder.pm
===================================================================
RCS file: /home/cvs/ITSMChangeManagement/Kernel/System/ITSMChange/ITSMWorkOrder.pm,v
retrieving revision 1.136
retrieving revision 1.137
diff -2 -u -d -r1.136 -r1.137
--- ITSMWorkOrder.pm	31 May 2013 13:59:30 -0000	1.136
+++ ITSMWorkOrder.pm	28 Jun 2013 13:02:29 -0000	1.137
@@ -1418,7 +1418,7 @@
         next ARRAYPARAM if !@{ $Param{$ArrayParam} };
 
-        # quote
+        # quote as integer
         for my $OneParam ( @{ $Param{$ArrayParam} } ) {
-            $OneParam = $DBObject->Quote($OneParam);
+            $OneParam = $DBObject->Quote( $OneParam, 'Integer' );
         }
 
---------------------------------------------------------------------
OTRS mailing list: cvs-log - Webpage: http://otrs.org/
Archive: http://lists.otrs.org/pipermail/cvs-log
To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/cvs-log