summaryrefslogtreecommitdiff
path: root/LedgerSMB
diff options
context:
space:
mode:
authoreinhverfr <einhverfr@4979c152-3d1c-0410-bac9-87ea11338e46>2006-10-29 05:57:29 +0000
committereinhverfr <einhverfr@4979c152-3d1c-0410-bac9-87ea11338e46>2006-10-29 05:57:29 +0000
commitfe9b8218fcb8035748782c3e033f103c4d039646 (patch)
tree60e9a7ac2ec1188494fd3dfae7d1d0d418cc78da /LedgerSMB
parent7115837a50a690c8740af2365120d8c32f9c1adc (diff)
Done removing SQL injection issues from User.pm
git-svn-id: https://ledger-smb.svn.sourceforge.net/svnroot/ledger-smb/trunk@377 4979c152-3d1c-0410-bac9-87ea11338e46
Diffstat (limited to 'LedgerSMB')
-rwxr-xr-xLedgerSMB/User.pm72
1 files changed, 37 insertions, 35 deletions
diff --git a/LedgerSMB/User.pm b/LedgerSMB/User.pm
index cd9f3728..fabcde51 100755
--- a/LedgerSMB/User.pm
+++ b/LedgerSMB/User.pm
@@ -23,7 +23,7 @@
#
#======================================================================
#
-# This file has NOT undergone whitespace cleanup.
+# This file has undergone whitespace cleanup.
#
#======================================================================
#
@@ -814,59 +814,61 @@ sub save_member {
sub delete_login {
- my ($self, $form) = @_;
+ my ($self, $form) = @_;
- my $dbh = DBI->connect($form->{dbconnect}, $form->{dbuser}, $form->{dbpasswd}, {AutoCommit} => 0) or $form->dberror;
+ my $dbh = DBI->connect(
+ $form->{dbconnect}, $form->{dbuser}, $form->{dbpasswd},
+ {AutoCommit => 0})
+ or $form->dberror;
- my $login = $form->{login};
- $login =~ s/@.*//;
- my $query = qq|SELECT id FROM employee
- WHERE login = '$login'|;
- my $sth = $dbh->prepare($query);
- $sth->execute || $form->dberror($query);
+ my $login = $form->{login};
+ $login =~ s/@.*//;
+ my $query = qq|SELECT id FROM employee WHERE login = ?|;
+ my $sth = $dbh->prepare($query);
+ $sth->execute($login) || $form->dberror($query);
- my ($id) = $sth->fetchrow_array;
- $sth->finish;
+ my ($id) = $sth->fetchrow_array;
+ $sth->finish;
- my $query = qq|UPDATE employee SET
- login = NULL,
- enddate = current_date
- WHERE login = '$login'|;
- $dbh->do($query);
-
- $dbh->commit;
- $dbh->disconnect;
+ my $query = qq|
+ UPDATE employee
+ SET login = NULL,
+ enddate = current_date
+ WHERE login = ?|;
+ $sth = $dbh->prepare($query);
+ $sth->execute($login);
+ $dbh->commit;
+ $dbh->disconnect;
}
sub config_vars {
- my @conf = qw(acs address businessnumber company countrycode
- currency dateformat dbconnect dbdriver dbhost dbname dboptions
- dbpasswd dbport dbuser email fax menuwidth name numberformat
- password printer role sid signature stylesheet tel
- templates timeout vclimit);
+ my @conf =
+ qw(acs address businessnumber company countrycode
+ currency dateformat dbconnect dbdriver dbhost dbname dboptions
+ dbpasswd dbport dbuser email fax menuwidth name numberformat
+ password printer role sid signature stylesheet tel templates
+ timeout vclimit);
- @conf;
+ @conf;
}
sub error {
- my ($self, $msg) = @_;
-
- if ($ENV{HTTP_USER_AGENT}) {
- print qq|Content-Type: text/html
+ my ($self, $msg) = @_;
-<body bgcolor=ffffff>
+ if ($ENV{HTTP_USER_AGENT}) {
+ print qq|Content-Type: text/html\n\n|.
+ qq|<body bgcolor=ffffff>\n\n|.
+ qq|<h2><font color=red>Error!</font></h2>\n|.
+ qq|<p><b>$msg</b>|;
-<h2><font color=red>Error!</font></h2>
-<p><b>$msg</b>|;
-
- }
+ }
- die "Error: $msg\n";
+ die "Error: $msg\n";
}