Fix error 500 on user creation, SQLI and windows debug php fix#1218
Fix error 500 on user creation, SQLI and windows debug php fix#1218Leproide wants to merge 13 commits intoitflow-org:developfrom Leproide:master
Conversation
v25.02.2 Maint / Small Feature Release
v25.02.3 - Stable Minor Release
v25.02.4 - Stable Minor Release
Merge Develop into Master
Merge Develop into Master
Develop to Master
Develop to Master for 25.03.3 release
Develop to Master for 25.03.4 Release
Develop to Master - 25.03.5 Release
Develop to Master 25.03.6
require_once 'post/admin/admin_user_model.php';
$name = trim($_POST['name']);
$email = trim($_POST['email']);
$password_plain = trim($_POST['password']);
$password = password_hash($password_plain, PASSWORD_DEFAULT);
$user_specific_encryption_ciphertext = encryptUserSpecificKey($password_plain);
$role = intval($_POST['role']); // Evita injection anche qui
$stmt = $mysqli->prepare("INSERT INTO users
(user_name, user_email, user_password, user_specific_encryption_ciphertext, user_role_id)
VALUES (?, ?, ?, ?, ?)");
$stmt->bind_param("ssssi", $name, $email, $password, $user_specific_encryption_ciphertext, $role);
$stmt->execute();
$user_id = $stmt->insert_id;
Removed /dev/null (Not work on windows)
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hello & Welcome! :)
Thanks for taking the time to help improve ITFlow. We're excited to review your contributions - we'll review this PR as soon as we can!
Whilst you're waiting, please feel free to check out the forum.
Just so you know, all contributions to ITFlow are licensed under the GNU GPL. By contributing you grant us a perpetual & irrevocable license to include your work in ITFlow.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| ]; | ||
| $mail = addToMailQueue($data); | ||
|
|
||
| if ($mail !== true) { |
Check failure
Code scanning / SonarCloud
Database queries should not be vulnerable to injection attacks High
| $mail = addToMailQueue($data); | ||
|
|
||
| if ($mail !== true) { | ||
| mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Mail', notification = 'Failed to send email to $email'"); |
Check failure
Code scanning / SonarCloud
Database queries should not be vulnerable to injection attacks High
|
|
||
| } | ||
| } | ||
|
|
Check failure
Code scanning / SonarCloud
Database queries should not be vulnerable to injection attacks High
| } | ||
|
|
||
| if (!empty($two_fa) && $two_fa == 'disable') { | ||
| mysqli_query($mysqli, "UPDATE users SET user_token = '' WHERE user_id = '$user_id'"); |
Check failure
Code scanning / SonarCloud
Database queries should not be vulnerable to injection attacks High
|
Nice... other problem xD |
require_once __DIR__ . '/config.php'; require_once __DIR__ . '/functions.php'; require_once __DIR__ . '/includes/check_login.php'; require_once __DIR__ . '/plugins/totp/totp.php'; // TOTP MFA Lib
|
|
Hello. Thanks for getting in touch and looking this, but we have no interest in Windows support for now. |
3 participants
#1217