admin/Facilitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FSN#19764 SQL*Injection

Browse Source 
svn path=/Website/trunk/; revision=3131
This commit is contained in:
Jos Groot Lipman
2011-02-03 08:55:24 +00:00
parent a27aebef8d
commit abfa54e612
3 changed files with 62 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
APPL/FAC/fac_usrrap_infobord.asp
View File

@@ -1,7 +1,7 @@
<%@language = "javascript" %>
<% /*
$Revision: 4 $
$Modtime: 25-01-11 16:52 $
$Revision: 5 $
$Modtime: 2-02-11 17:36 $
File: fac_usrrap_infobord.asp
Description: Toon een bepaald (usr)rapport en ververs deze regelmatig
@@ -10,7 +10,7 @@
rap_key=23 // key of the record in the FAC_USRRAP table
optional parameters
refreshrate=10 // report is refreshed every 10 seconds
sqlWhere // filtervelden op de view
sqlWhere // DEPRECATED!!
Context: Bijvoorbeeld Cust\BOFO\infobord\infobordvk.asp
Notes: Pas op dat functies als Activate() mogelijk vanuit een XSL worden aangeroepen
@@ -26,6 +26,8 @@
var p_rap_key = getQParamInt("rap_key");
var p_refreshrate = getQParamInt("refreshrate", usrrap_refreshrate);
var sqlWhere = getQParam("sqlWhere","");
if (sqlWhere != "")
INTERNAL_ERROR_DEPRECATED_SQLWHERE_USAGE;
var session_customerId = customerId;
var session_user_key = user_key;
@@ -52,18 +54,29 @@
<head>
<%
FCLTHeader.Generate();
// Transit van de eventuele filtervelden
transitParam="";
var i = 1;
while (getQParam("fclt_f_colname" + i, "") != "")
{
transitParam += buildTransitParam(["fclt_f_colname" + i, "fclt_f_colvalue" + i]);
i++;
}
%>
<script language="javascript">
function startSearch()
{
// JGL: Afgezien van de transit zit dit (standalone rapport) h<><68>l dicht tegen API/api_fetchXML.asp aan
var cmd;
cmd = "fac_usrrap_list.asp?";
cmd += "usrrap_key=" + <%=p_rap_key%>;
cmd += "&session_customerId=<%=session_customerId%>";
cmd += "&session_user_key=<%=session_user_key%>";
cmd += "&sqlWhere=<%=sqlWhere%>";
cmd += "&standAlone=1";
cmd += "<%=transitParam%>";
if (document.all.activeFrame.value == 2)
window.frames.workFrame3.navigate(cmd);

62
APPL/FAC/fac_usrrap_list.asp
View File

@@ -1,7 +1,7 @@
<%@ language = "JavaScript" %>
<% /*
$Revision: 18 $
$Modtime: 26-01-11 13:41 $
$Revision: 19 $
$Modtime: 3-02-11 10:55 $
File: fac_usrrap_list.asp
Description: Actually create the user report as selected in usrreport.asp
@@ -9,24 +9,26 @@
Parameters:
usrrap_key Key in the FAC_USRRAP table
standAlone Do not add html tags. All formatting is provided by the outcome of the stylesheet
TODO: Deze via api/api_fetchXML.asp implementeren
excel ??
print_table ??
Context: When report is executed
Notes: session_user_key en session_customerId zijn voor sessie-bescherming vanuit
fac_usrrap_infobord.asp die 24/7 moet kunnen aanstaan, incl. de nachtelijke recycle
(maar worden ook misbruikt voor WELK XML API)
(maar worden ook nog misbruikt voor WELK XML API)
TODO:
- resulttable gebruiken als dat enigszins mogelijk is
*/
var standAlone = getQParamInt("standAlone", 0) == 1;
var outputmode = 0;
if (standAlone) { // WELK vanuit deeplink?
if (standAlone) {
DOCTYPE_Disable = 1;
var session_customerId = getQParam("session_customerId", "");
var session_user_key = getQParamInt("session_user_key", -1);
Session("customerId") = "" + session_customerId;
Session("user_key") = "" + session_user_key;
Session.Abandon(); // Dat mag gedocumenteerd al heel vroeg!
}
%>
@@ -128,18 +130,8 @@ if (!standAlone) {
if (ora_date2P)
sShowFilter += "<tr><td class=formheader>"+lcl_to+"</td><td>" + toDateString(ora_date2P) + "</td></tr>";
if (rapport_view(func_key)) // Normal view
{
sql = "select webfac.fac_f_usrrap_query('" + p_tableName + "') from dual";
oRs = Oracle.Execute(sql);
sql1 = oRs.Fields(0).Value;
oRs.close();
sql = "select webfac.fac_f_usrrap_orderby('" + p_tableName + "') from dual";
oRs = Oracle.Execute(sql);
sql3 = oRs.Fields(0).Value;
oRs.close();
// sql2 bevat straks de filtering op filtervelden uit het scherm
// of op waarden vanuit fac_usrrap_infobord
sql2 = "";
sql_cond = " WHERE ";
var i = 1;
@@ -155,21 +147,38 @@ if (rapport_view(func_key)) // Normal view
var p_col_value = "" + getQParam("fclt_f_colvalue" + i, "");
if (p_col_value != "")
{
sql2 = sql2 + sql_cond + "UPPER(" + p_col_name + ") like " + safe.quoted_sql_upper(p_col_value);
if (p_col_name.match(/_key$/i))
sql2 = sql2 + sql_cond + p_col_name + "=" + parseInt(p_col_value, 10);
else
sql2 = sql2 + sql_cond + "UPPER(" + p_col_name + ") like " + safe.quoted_sql_upper(p_col_value);
sql_cond = " and ";
sShowFilter += "<tr><td class=formheader>" + p_col_name.substring(7) + "</td>"
+ "<td>" + p_col_value + "</td></tr>";
}
i++;
}
if (ora_date1P && ora_date_fld != ""){
sql2 = sql2 + sql_cond + "TO_DATE(" + ora_date_fld + ",'dd-mm-yyyy') >= " + ora_date1P.toSQL();
sql_cond = " and ";
}
if (ora_date2P && ora_date_fld != ""){
sql2 = sql2 + sql_cond + "TO_DATE(" + ora_date_fld + ",'dd-mm-yyyy') < " + ora_date2P.toSQL();
sql_cond = " and ";
}
if (ora_date1P && ora_date_fld != ""){
sql2 = sql2 + sql_cond + "TO_DATE(" + ora_date_fld + ",'dd-mm-yyyy') >= " + ora_date1P.toSQL();
sql_cond = " and ";
}
if (ora_date2P && ora_date_fld != ""){
sql2 = sql2 + sql_cond + "TO_DATE(" + ora_date_fld + ",'dd-mm-yyyy') < " + ora_date2P.toSQL();
sql_cond = " and ";
}
if (rapport_view(func_key)) // Normal view
{
sql = "select webfac.fac_f_usrrap_query('" + p_tableName + "') from dual";
oRs = Oracle.Execute(sql);
sql1 = oRs.Fields(0).Value;
oRs.close();
sql = "select webfac.fac_f_usrrap_orderby('" + p_tableName + "') from dual";
oRs = Oracle.Execute(sql);
sql3 = oRs.Fields(0).Value;
oRs.close();
if (sqlWhere != "")
{
sql2 += sql_cond + sqlWhere
@@ -374,9 +383,6 @@ else { // In alle andere gevallen, dus normaliter (bij gevulde oRs) zijn dat nog
</body>
</html>
<% }
else {
Session.Abandon()
}
}
Oracle.RealConnection.Close()
} // End else: In alle andere gevallen... %>

24
CUST/BOFO/infobord/infobordvk.asp
View File

@@ -1,13 +1,13 @@
<%@ language = "JavaScript" %>
<% /*
$Revision: 2 $
$Modtime: 17-02-10 10:32 $
$Revision: 3 $
$Modtime: 3-02-11 10:29 $
File: infobordvk.asp
Description: A deeplink call to display information on the infobord
Parameters:
vk verkoopkamer: the number of the verkoopkamer
Context:
Note:
Context:
Note:
*/ %>
<%
@@ -17,23 +17,19 @@
%>
<!-- #include file="../../../cust/install.inc" -->
<!-- #include file="../../../appl/Shared/funcodes.inc" -->
<!-- #include file="../../../appl/Shared/date_sql.inc" -->
<!-- #include file="../../../appl/Shared/escape.inc" -->
<html>
<head>
<%
// specific params needed to find the reservation which has to be deleted
var vk = Request.QueryString("vk").Count>0?Request.QueryString("vk"):-1;
var refreshrate = Request.QueryString("refreshrate").Count>0?parseInt(Request.QueryString("refreshrate"),10):-1;
var vk = getQParam("vk", "onbekend");
var refreshrate = getQParamInt("refreshrate", -1);
// find res_ruimte_key of the verkoopkamer
var res_ruimte_key = -1;
sql = "SELECT res_ruimte_key"
+ " FROM res_ruimte rr"
+ " WHERE UPPER(res_ruimte_nr) like UPPER('%["+vk+"]%')"
+ " WHERE UPPER(res_ruimte_nr) like " + safe.quoted_sql_upper("%["+vk+"]%")
+ " AND rr.res_ruimte_verwijder IS NULL";
oRs = Oracle.Execute(sql);
if (!oRs.eof) {
@@ -50,6 +46,8 @@
fac_usrrap_key = oRs(0).value;
}
var params = "";
params += "&fclt_f_colname1=res_ruimte_key&fclt_f_colvalue1=" + res_ruimte_key;
%>
@@ -61,10 +59,10 @@
<% if (fac_usrrap_key == -1 || res_ruimte_key == -1 ) { %>
alert ("rapport of ruimte kan niet gevonden worden");
<% } else { %>
var s = "../../../Appl/FAC/fac_usrrap_infobord.asp?rap_key=<%=fac_usrrap_key%>&sqlWhere=res_ruimte_key%3d<%=res_ruimte_key%>&refreshrate=<%=refreshrate%>";
var s = "../../../Appl/FAC/fac_usrrap_infobord.asp?rap_key=<%=fac_usrrap_key%><%=params%>&refreshrate=<%=refreshrate%>";
window.navigate(s);
<% } %>
}
</script>
</body>
</head>
</html>