Kimirock/osTicket
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xss: Search parent_id

Browse Source 
This mitigates a vulnerability reported by @indevi0us where XSS is
possible via the parent_id parameter. This forces the parameter to an
INT so that there is no chance of XSS.
This commit is contained in:
JediKev
2023-03-08 10:35:56 -06:00
parent 091ddba965
commit ec6043935b
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
include/ajax.search.php
View File

@@ -31,7 +31,7 @@ class SearchAjaxAPI extends AjaxController {
$search = new AdhocSearch(array(
'root' => 'T',
'staff_id' => $thisstaff->getId(),
'parent_id' => @$_GET['parent_id'] ?: 0,
'parent_id' => (int) @$_GET['parent_id'] ?: 0,
));
if ($search->parent_id) {
$search->flags |= SavedSearch::FLAG_INHERIT_COLUMNS;
@@ -168,7 +168,7 @@ class SearchAjaxAPI extends AjaxController {
'title' => __('Add Queue'),
'root' => 'T',
'staff_id' => $thisstaff->getId(),
'parent_id' => $_GET['pid'],
'parent_id' => (int) $_GET['pid'],
));
$this->_tryAgain($search);
}

4
include/staff/templates/advanced-search.tmpl.php
View File

@@ -1,9 +1,9 @@
<?php
global $thisstaff;
$parent_id = (isset($_REQUEST['parent_id']) && is_numeric($_REQUEST['parent_id']))
$parent_id = (int) ((isset($_REQUEST['parent_id']) && is_numeric($_REQUEST['parent_id']))
? $_REQUEST['parent_id']
: $search->parent_id;
: $search->parent_id);
if ($parent_id
&& is_numeric($parent_id)
&& (!($parent = SavedQueue::lookup($parent_id)))