FCLT#54933 Filename injection voorkomen

svn path=/Website/branches/v2018.1/; revision=39368
2018-10-11 14:58:22 +00:00
parent 40889e5c92
commit f9478183f1
1 changed files with 1 additions and 1 deletions
--- a/APPL/CAD/tek_file_save.asp
+++ b/APPL/CAD/tek_file_save.asp
@@ -34,7 +34,7 @@ if (cad_tek_key > 0)
 {
  if (file != "")
    sql = "UPDATE cad_tekening"
-        + "   SET cad_tekening_filenaam = " + safe.quoted_sql(file)
+        + "   SET cad_tekening_filenaam = " + safe.quoted_sql(safe.filename(file))
        + " WHERE cad_tekening_key = " + cad_tek_key;
  else
    sql = "DELETE FROM cad_tekening"