ben.carrasco/freeswitch
1
0 Fork 0
mirror of https://github.com/signalwire/freeswitch.git synced 2026-10-30 07:04:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

FS-9652: improve sql sanitization

Browse Source
This commit is contained in:
Mike Jerris committed 2016-11-11 11:27:35 -06:00
1 parent 53dbe5d84a
commit e1b3ee1efd
20 files changed
+148 -145
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/mod/applications/mod_directory/mod_directory.c
+7 -4
View File
@@ -863,14 +863,17 @@ switch_status_t navigate_entrys(switch_core_session_t *session, dir_profile_t *p
cbt.len = sizeof(entry_count);
if (params->search_by == SEARCH_BY_FIRST_AND_LAST_NAME) {
sql_where = switch_mprintf("hostname = '%q' and uuid = '%q' and name_visible = 1 and (%s like '%q%%' or %s like '%q%%')",
sql_where = switch_mprintf("hostname = '%q' and uuid = '%q' and name_visible = 1 and (%q like '%q%%' or %q like '%q%%')",
globals.hostname, switch_core_session_get_uuid(session), "last_name_digit", params->digits, "first_name_digit", params->digits);
} else if (params->search_by == SEARCH_BY_FULL_NAME) {
sql_where = switch_mprintf("hostname = '%q' and uuid = '%q' and name_visible = 1 and full_name_digit like '%%%q%%'",
globals.hostname, switch_core_session_get_uuid(session), "last_name_digit", params->digits, "first_name_digit", params->digits);
globals.hostname, switch_core_session_get_uuid(session), params->digits);
} else if (params->search_by == SEARCH_BY_LAST_NAME) {
sql_where = switch_mprintf("hostname = '%q' and uuid = '%q' and name_visible = 1 and last_name_digit like '%q%%'",
globals.hostname, switch_core_session_get_uuid(session), params->digits);
} else {
sql_where = switch_mprintf("hostname = '%q' and uuid = '%q' and name_visible = 1 and %s like '%q%%'",
globals.hostname, switch_core_session_get_uuid(session), (params->search_by == SEARCH_BY_LAST_NAME ? "last_name_digit" : "first_name_digit"), params->digits);
sql_where = switch_mprintf("hostname = '%q' and uuid = '%q' and name_visible = 1 and first_name_digit like '%q%%'",
globals.hostname, switch_core_session_get_uuid(session), params->digits);
}
sql = switch_mprintf("select count(*) from (select distinct first_name, last_name, extension from directory_search where %s) AS dsearch", sql_where);