Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed most SQL Injections #20

Merged
merged 8 commits into from Apr 30, 2019
Merged

Fixed most SQL Injections #20

merged 8 commits into from Apr 30, 2019

Conversation

Stefar77
Copy link
Contributor

@Stefar77 Stefar77 commented Apr 24, 2019

Did a few fixes yesterday.
Still needs more fixes (like filtering for shell injections) and some more tweaks, working on that tonight.
I may split up the clonos object into separate objects (i.e. jail, bhyve, node) next update.

  • Also still working on the formatting a bit, it's a pain to read when single commands span multiple lines without exceeding low-res text screen lengths. (~80 cols)

Still needs more fixes (like shell injections)
Made the Db object handle escaping so you can use other types of databases / escaping.
@olevole olevole requested a review from moveee April 25, 2019 12:08
Fixed ($db!==false) stuff, that's impossible you will always get an object with $var=new Object(); unless it's out of ram but that kills PHP.
replaced it with isConnected() method.
Also fixed edit bhyve form memory value, it was annoying me.
Still need a full read but since I'm about to split up some code I'll review it later in parts.
* Should first fix the shell injections I guess..
@olevole olevole self-requested a review April 25, 2019 14:12
@olevole
Copy link
Member

olevole commented Apr 25, 2019

@Stefar77 looks good! Please merge it!

No more string concats in queries to make it a bit more readable.
Some more style fixes, also marked some XSS and possible shell injections.
Copy link
Contributor Author

@Stefar77 Stefar77 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Next step is fix the shell injections (without breaking anything) and splitting up some stuff into own classes to make it more manageable.

SQL commands look nicer in uppercase and also makes it a bit more readable or a bit faster to find the different parts of the query..
Sorry, unit test will come soon...
@olevole olevole merged commit a2d5062 into clonos:master Apr 30, 2019
@olevole
Copy link
Member

olevole commented Apr 30, 2019

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants