Skip to content
Permalink
Browse files

MDL-15184: fix sql injection vulnerability

  • Loading branch information...
gbateson
gbateson committed Jul 1, 2008
1 parent 36ea9a6 commit e5e02e46861f9c1b88782cb1ef8737253412be33
Showing with 8 additions and 4 deletions.
  1. +8 −4 mod/hotpot/report.php
@@ -380,10 +380,14 @@ function hotpot_delete_selected_attempts(&$hotpot, $del) {
$select = "hotpot=:hotpotid AND status=".HOTPOT_STATUS_ABANDONED;
break;
case 'selection':
$ids = (array)data_submitted();
unset($ids['del']);
unset($ids['id']);
if (!empty($ids)) {
$ids = array();
$data = (array)data_submitted();
foreach ($data as $name => $value) {
if (preg_match('/^box\d+$/', $name)) {
$ids[] = intval($value);
}
}
if (count($ids)) {
list($ids, $idparams) = $DB->get_in_or_equal($ids, SQL_PARAMS_NAMED, 'crid0');
$params = array_merge($params, $idparams);
$select = "hotpot=:hotpotid AND clickreportid $ids";

0 comments on commit e5e02e4

Please sign in to comment.
You can’t perform that action at this time.