ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Default security fixes, CVE-2021-28854

Browse Source 
git-svn-id: svn://192.168.202.10@3454 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2021-06-15 15:10:25 +00:00
parent 0013d84fa8
commit d4bd530333
19 changed files with 158 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/www/agc/functions.php
+6 -4
View File
@@ -55,6 +55,7 @@
# 210401-2132 - Fixed issue #1271, security_phrase field not populating in custom fields form
# 210404-0902 - Added function to refresh a single field
# 210603-1616 - Fix for specific custom field values with a slash in them
# 210615-1032 - Default security fixes, CVE-2021-28854
#
# $mysql_queries = 26
@@ -155,8 +156,8 @@ function user_authorization($user,$pass,$user_option,$user_update,$bcrypt,$retur
}
if ($SSwebroot_writable > 0)
{
$fp = fopen ("./project_auth_entries.txt", "a");
fwrite ($fp, "AGENT|FAIL|$NOW_TIME|$user|$auth_key|$ip|$browser|\n");
$fp = fopen ("./project_auth_entries.txt", "w");
fwrite ($fp, "AGENT|FAIL|$NOW_TIME|\n");
fclose($fp);
}
}
@@ -2689,8 +2690,9 @@ function mysql_error_logging($NOW_TIME,$link,$mel,$stmt,$query_id,$user,$server_
if ( ($errno > 0) or ($mel > 1) or ($one_mysql_log > 0) )
{
$error = mysqli_error($link);
$efp = fopen ("./vicidial_mysqli_errors.txt", "a");
fwrite ($efp, "$NOW_TIME|vdc_db_query|$query_id|$errno|$error|$stmt|$user|$server_ip|$session_name|\n");
$efp = fopen ("./vicidial_mysqli_errors.txt", "w");
# fwrite ($efp, "$NOW_TIME|vdc_db_query|$query_id|$errno|$error|$stmt|$user|$server_ip|$session_name|\n");
fwrite ($efp, "$NOW_TIME|vdc_db_query|$query_id|\n");
fclose($efp);
}
}