From ef0c3c23bf69c6bd02291e4aa85b1a265b95eb7d Mon Sep 17 00:00:00 2001 From: mattf Date: Sat, 22 Apr 2017 12:01:32 +0000 Subject: [PATCH] Added input variable filtering to server performance report git-svn-id: svn://192.168.202.10@2736 3d104415-ff17-0410-8863-d5cf3c621b8a --- agc_2-X/trunk/www/vicidial/AST_server_performance.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/agc_2-X/trunk/www/vicidial/AST_server_performance.php b/agc_2-X/trunk/www/vicidial/AST_server_performance.php index 2c68fee9..af1007f1 100644 --- a/agc_2-X/trunk/www/vicidial/AST_server_performance.php +++ b/agc_2-X/trunk/www/vicidial/AST_server_performance.php @@ -26,6 +26,7 @@ # 141114-0730 - Finalized adding QXZ translation to all admin files # 141230-1440 - Added code for on-the-fly language translations display # 170409-1550 - Added IP List validation code +# 170422-0750 - Added input variable filtering # $startMS = microtime(); @@ -82,6 +83,10 @@ else $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); } +$begin_query_time = preg_replace('/[^- \:_0-9a-zA-Z]/', '', $begin_query_time); +$end_query_time = preg_replace('/[^- \:_0-9a-zA-Z]/', '', $end_query_time); +$group = preg_replace('/[^\._0-9a-zA-Z]/', '', $group); + $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -529,7 +534,7 @@ else echo "\n"; echo "\n"; - echo ""; + #echo ""; } if ($db_source == 'S')