Rooba
/
boinc
mirror of https://github.com/BOINC/boinc.git
1
0
Fork 0
Code Issues 1 Packages Projects Releases Wiki Activity

web: remove vulnerabilities in tree_threader and in unused badge function

This commit is contained in:
David Anderson 2024-12-18 15:54:25 -08:00
parent 57e0bdf3a7
commit b51b3e44b0
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
html/inc/util_ops.inc
View File

@ -331,6 +331,9 @@ function app_version_desc($avid) {
////// badge-related stuff
function get_badge($name, $title, $image_url) {
$name = BoincDb::escape_string($name);
$title = BoincDb::escape_string($title);
$image_url = BoincDb::escape_string($image_url);
$b = BoincBadge::lookup("name='$name'");
if ($b) return $b;
$now = time();

4
html/user/tree_threader.php
View File

@ -1,5 +1,7 @@
<?php
DEPRECATED
// Handler for TreeThreader remote job submission.
//
// Assumptions:
@ -155,7 +157,7 @@ if (!$r) {
// authenticate the user
//
$auth = (string)$r->auth;
$auth = BoincDb::escape_string((string)$r->auth);
$user = BoincUser::lookup("authenticator='$auth'");
if (!$user) error("invalid authenticator");
$user_submit = BoincUserSubmit::lookup_userid($user->id);