Changeset 586 for trunk/Modules/Log

Timestamp:

Oct 7, 2013, 11:52:11 PM (11 years ago)

Author:

chronos

Message:

• Fixed: SQL injection protection was not applied because of new dynamic URL handling.
• Fixed: HTML entities encodin for search input string.

File:

• trunk/Modules/Log/Log.php (modified) (2 diffs)

trunk/Modules/Log/Log.php

@@ -79 +79 @@
     if(array_key_exists('type', $_GET)) $Where = ' WHERE `Type` = "'.($_GET['type'] * 1).'"'; 
       else $Where = '';
-    $sql = 'SELECT *, UNIX_TIMESTAMP(`Date`) AS `TimeCreate`, (SELECT `User`.`Name` FROM `User` WHERE `User`.`ID` = `Log`.`User`) AS `UserName` FROM `Log`'.$Where.' ORDER BY `Date` DESC LIMIT 100';
+    $sql = 'SELECT *, UNIX_TIMESTAMP(`Date`) AS `TimeCreate`, (SELECT `User`.`Name` FROM `User` WHERE `User`.`ID` = `Log`.`User`) AS `UserName` FROM `Log`'.
+      $Where.' ORDER BY `Date` DESC LIMIT 100';
     $DbResult = $this->System->Database->query($sql);
     while($Line = $DbResult->fetch_assoc()) 
@@ -93 +94 @@
         'Title' => $LogType['Name'].' ('.$Line['UserName'].', '.$Line['IP'].')',
         'Link' => 'http://'.$this->System->Config['Web']['Host'].$this->System->Link('/log.php'),
-        'Description' => $LogType['Name'].': '.$Line['Text'].' ('.$Line['UserName'].', '.$Line['IP'].')',
+        'Description' => $LogType['Name'].': '.$Line['Text'].' ('.$Line['UserName'].', '.$Line['IP'].', '.$Line['TimeCreate'].')',
         'Time' => $Line['TimeCreate'],
       );