dbxe/fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Improve the security on the delete for devices by validating the uuid and fix the delete when deleting a key from a global device profile.

Browse Source
This commit is contained in:
Mark Crane
2015-03-07 07:03:22 +00:00
parent 23a34df36f
commit fc2f5ecb6b
5 changed files with 117 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/devices/device_delete.php
+8 -12
View File
@@ -38,39 +38,35 @@ else {
$text = $language->get();
//get the id
if (count($_GET) > 0) {
$id = check_str($_GET["id"]);
if (isset($_GET["id"])) {
$id = $_GET["id"];
}
//delete the data and subdata
if (strlen($id) > 0) {
//delete the data and sub-data
if (is_uuid($id)) {
//delete device_lines
$sql = "delete from v_device_lines ";
$sql .= "where device_uuid = '$id' ";
$prep_statement = $db->prepare(check_sql($sql));
$prep_statement->execute();
$db->exec($sql);
unset($sql);
//delete device_keys
$sql = "delete from v_device_keys ";
$sql .= "where device_uuid = '$id' ";
$prep_statement = $db->prepare(check_sql($sql));
$prep_statement->execute();
$db->exec($sql);
unset($sql);
//delete device_settings
$sql = "delete from v_device_settings ";
$sql .= "where device_uuid = '$id' ";
$prep_statement = $db->prepare(check_sql($sql));
$prep_statement->execute();
$db->exec($sql);
unset($sql);
//delete the device
$sql = "delete from v_devices ";
$sql .= "where device_uuid = '$id' ";
$prep_statement = $db->prepare(check_sql($sql));
$prep_statement->execute();
$db->exec($sql);
unset($sql);
}