Fixed: Possible SQL injection

i-MSCP · Jun 20, 2018 · eeb6eb5 · eeb6eb5
1 parent 0b01a3c
commit eeb6eb5
Showing 1 changed file with 7 additions and 3 deletions.
diff --git a/frontend/library/classes/Functions/Counting.php b/frontend/library/classes/Functions/Counting.php
@@ -193,11 +193,15 @@ public static function getSqlUsersCount(): int
      */
     public static function getObjectsCount(string $table, string $objectIDfield, string $where = NULL, ?$params = []): int
     {
-        $qb = Application::getInstance()->getEntityManager()->getConnection()->createQueryBuilder()->select("COUNT($objectIDfield)")->from($table);
+        $qb = Application::getInstance()
+            ->getEntityManager()
+            ->getConnection()
+            ->createQueryBuilder()
+            ->select("COUNT($objectIDfield)")
+            ->from($table);
 
         if ($where !== NULL) {
             $qb->where($where);
-
             if (!empty($params)) {
                 $qb->setParameters($params);
             }
@@ -235,7 +239,7 @@ public static function getObjectsCounts(): array
      */
     public static function getResellerClientsCount(int $resellerId): int
     {
-        return static::getObjectsCount('imscp_user', 'userID', "createdBy = $resellerId");
+        return static::getObjectsCount('imscp_user', 'userID', 'createdBy = ?' [$resellerId]);
     }
 
     /**