From fe9b8218fcb8035748782c3e033f103c4d039646 Mon Sep 17 00:00:00 2001 From: einhverfr Date: Sun, 29 Oct 2006 05:57:29 +0000 Subject: Done removing SQL injection issues from User.pm git-svn-id: https://ledger-smb.svn.sourceforge.net/svnroot/ledger-smb/trunk@377 4979c152-3d1c-0410-bac9-87ea11338e46 --- LedgerSMB/User.pm | 72 ++++++++++++++++++++++++++++--------------------------- 1 file changed, 37 insertions(+), 35 deletions(-) (limited to 'LedgerSMB/User.pm') diff --git a/LedgerSMB/User.pm b/LedgerSMB/User.pm index cd9f3728..fabcde51 100755 --- a/LedgerSMB/User.pm +++ b/LedgerSMB/User.pm @@ -23,7 +23,7 @@ # #====================================================================== # -# This file has NOT undergone whitespace cleanup. +# This file has undergone whitespace cleanup. # #====================================================================== # @@ -814,59 +814,61 @@ sub save_member { sub delete_login { - my ($self, $form) = @_; + my ($self, $form) = @_; - my $dbh = DBI->connect($form->{dbconnect}, $form->{dbuser}, $form->{dbpasswd}, {AutoCommit} => 0) or $form->dberror; + my $dbh = DBI->connect( + $form->{dbconnect}, $form->{dbuser}, $form->{dbpasswd}, + {AutoCommit => 0}) + or $form->dberror; - my $login = $form->{login}; - $login =~ s/@.*//; - my $query = qq|SELECT id FROM employee - WHERE login = '$login'|; - my $sth = $dbh->prepare($query); - $sth->execute || $form->dberror($query); + my $login = $form->{login}; + $login =~ s/@.*//; + my $query = qq|SELECT id FROM employee WHERE login = ?|; + my $sth = $dbh->prepare($query); + $sth->execute($login) || $form->dberror($query); - my ($id) = $sth->fetchrow_array; - $sth->finish; + my ($id) = $sth->fetchrow_array; + $sth->finish; - my $query = qq|UPDATE employee SET - login = NULL, - enddate = current_date - WHERE login = '$login'|; - $dbh->do($query); - - $dbh->commit; - $dbh->disconnect; + my $query = qq| + UPDATE employee + SET login = NULL, + enddate = current_date + WHERE login = ?|; + $sth = $dbh->prepare($query); + $sth->execute($login); + $dbh->commit; + $dbh->disconnect; } sub config_vars { - my @conf = qw(acs address businessnumber company countrycode - currency dateformat dbconnect dbdriver dbhost dbname dboptions - dbpasswd dbport dbuser email fax menuwidth name numberformat - password printer role sid signature stylesheet tel - templates timeout vclimit); + my @conf = + qw(acs address businessnumber company countrycode + currency dateformat dbconnect dbdriver dbhost dbname dboptions + dbpasswd dbport dbuser email fax menuwidth name numberformat + password printer role sid signature stylesheet tel templates + timeout vclimit); - @conf; + @conf; } sub error { - my ($self, $msg) = @_; - - if ($ENV{HTTP_USER_AGENT}) { - print qq|Content-Type: text/html + my ($self, $msg) = @_; - + if ($ENV{HTTP_USER_AGENT}) { + print qq|Content-Type: text/html\n\n|. + qq|\n\n|. + qq|

Error!

\n|. + qq|

$msg|; -

Error!

$msg|; - - } + } - die "Error: $msg\n"; + die "Error: $msg\n"; } -- cgit v1.2.3