From 4b7387fa00e17b2ef8e85e91c5fabc5d95197f3e Mon Sep 17 00:00:00 2001 From: mattf Date: Fri, 19 May 2023 11:32:24 +0000 Subject: [PATCH] Fix for input variable filtering in api.php git-svn-id: svn://192.168.202.10@3726 3d104415-ff17-0410-8863-d5cf3c621b8a --- agc_2-X/trunk/www/agc/api.php | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/agc_2-X/trunk/www/agc/api.php b/agc_2-X/trunk/www/agc/api.php index 85e79609..e78439cf 100644 --- a/agc_2-X/trunk/www/agc/api.php +++ b/agc_2-X/trunk/www/agc/api.php @@ -109,10 +109,11 @@ # 220220-0847 - Added allow_web_debug system setting # 230412-0945 - Added send_notification function # 230413-1957 - Fix for send_notification user group permissions +# 230519-0731 - Fix for input variable filtering # -$version = '2.14-74'; -$build = '230413-1957'; +$version = '2.14-75'; +$build = '230519-0731'; $php_script = 'api.php'; $startMS = microtime(); @@ -352,7 +353,7 @@ if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); - $agent_user=preg_replace("/[^0-9a-zA-Z]/","",$agent_user); + $agent_user=preg_replace("/[^-_0-9a-zA-Z]/","",$agent_user); $function = preg_replace("/[^-\_0-9a-zA-Z]/","",$function); $value = preg_replace("/[^-\|\_0-9a-zA-Z]/","",$value); $focus = preg_replace("/[^-\_0-9a-zA-Z]/","",$focus); @@ -445,7 +446,7 @@ else { $user=preg_replace("/[^-_0-9\p{L}]/u","",$user); $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); - $agent_user=preg_replace("/[^0-9\p{L}]/u","",$agent_user); + $agent_user=preg_replace("/[^-_0-9\p{L}]/u","",$agent_user); $function = preg_replace("/[^-\_0-9\p{L}]/u","",$function); $value = preg_replace("/[^-\|\_0-9\p{L}]/u","",$value); $focus = preg_replace("/[^-\_0-9\p{L}]/u","",$focus);