jerome/winlog
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix : db_escape_string à la place de addslashes()

Browse Source
This commit is contained in:
jbousquie 2016-11-18 15:06:04 +01:00
parent a0bebfd5a8
commit e9ef77e1c6
1 changed files with 6 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
index.php
View File

@ -3,22 +3,15 @@ include_once('winlogconf.php');
include_once('admin/db_access.php');
// ne traiter que sur des requêtes POST sur le port 443
if ( $_SERVER["REQUEST_METHOD"] == "POST" && $_SERVER["SERVER_PORT"] == "443") {
if ( $_SERVER["REQUEST_METHOD"] == "POST" && $_SERVER["SERVER_PORT"] == "443" && strcmp(addslashes($_POST["code"]), addslashes($server_code)) ) {
$action = addslashes($_POST["action"]);
$username = addslashes($_POST["username"]);
$computer = addslashes($_POST["computer"]);
$code = $_POST["code"];
$ip = $_SERVER["REMOTE_ADDR"];
// se protéger des POST anonymes par un code partagé entre client et serveur
if (strcmp(addslashes($code), addslashes($server_code)) != 0) {
exit;
}
$db = db_connect();
$action = db_escape_string($db, $_POST["action"]);
$username = db_escape_string($db, $_POST["username"]);
$computer = db_escape_string($db, $_POST["computer"]);
$ip = $_SERVER["REMOTE_ADDR"];
// requête de purge d'une éventuelle connexion restée ouverte sur une machine (multi-session non autorisée sur les PC)
$req_purge_C = 'UPDATE connexions SET close = 1 WHERE close = 0 AND hote = "'.$computer.'"';
// requête de création de l'enregistrement de connexion