Merge pull request from GHSA-jwpv-7m4h-5gvc

* Prevent SQL injection through search API * better solution
glpi-project · Oct 6, 2020 · 3dc4475 · 3dc4475
1 parent 3ae40f0
commit 3dc4475
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/inc/api/api.class.php b/inc/api/api.class.php
@@ -1631,8 +1631,8 @@ protected function searchItems($itemtype, $params = []) {
       if (isset($params['criteria']) && is_array($params['criteria'])) {
 
          // use a recursive closure to check each nested criteria
-         $check_criteria = function($criteria) use (&$check_criteria, $soptions) {
-            foreach ($criteria as $criterion) {
+         $check_criteria = function(&$criteria) use (&$check_criteria, $soptions) {
+            foreach ($criteria as &$criterion) {
                // recursive call
                if (isset($criterion['criteria'])) {
                   return $check_criteria($criterion['criteria']);
@@ -1653,6 +1653,9 @@ protected function searchItems($itemtype, $params = []) {
                    && $soptions[$criterion['field']]['nosearch']) {
                   return __("Forbidden field ID in search criteria");
                }
+
+               // Escape value to prevent SQL injection
+               $criterion['value'] = Toolbox::addslashes_deep($criterion['value']);
             }
 
             return true;