ham-ref/cloudlog
1
0
Fork 0
mirror of https://github.com/magicbug/Cloudlog synced 2026-08-13 17:49:35 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add input validation and secure queries for VUCC details

Browse source 
Enhanced input validation for gridsquare and band parameters in Awards controller to prevent invalid data and potential abuse. Updated Logbook_model to use parameterized queries and early return for empty logbook relationships, improving security and reliability of VUCC QSO details retrieval.
This commit is contained in:
Peter Goodhall 2025-10-18 11:31:48 +01:00
parent 2d028e6e87
commit 7d64275095
2 changed files with 42 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

24
application/controllers/Awards.php
View file

@ -276,8 +276,28 @@ class Awards extends CI_Controller
{
$this->load->model('logbook_model');
$gridsquare = str_replace('"', "", $this->security->xss_clean($this->input->post("Gridsquare")));
$band = str_replace('"', "", $this->security->xss_clean($this->input->post("Band")));
// Validate and sanitize gridsquare input - should be alphanumeric only, max 6 characters
$gridsquare_raw = $this->input->post("Gridsquare");
$band_raw = $this->input->post("Band");
// Validate gridsquare format (should match standard grid square format)
if (!$gridsquare_raw || !preg_match('/^[A-Ra-r]{2}[0-9]{2}[A-Xa-x]{0,2}$/', $gridsquare_raw)) {
show_error('Invalid gridsquare format', 400);
return;
}
// Validate band - use Cloudlog's band system for validation
$this->load->model('bands');
$valid_bands = array_keys($this->bands->bandslots);
$valid_bands[] = 'All'; // Add 'All' as a valid option
if (!$band_raw || !in_array($band_raw, $valid_bands)) {
show_error('Invalid band specified', 400);
return;
}
$gridsquare = strtoupper($gridsquare_raw);
$band = $band_raw;
$data['results'] = $this->logbook_model->vucc_qso_details($gridsquare, $band);
// Render Page

29
application/models/Logbook_model.php
View file

@ -556,23 +556,34 @@ class Logbook_model extends CI_Model
$CI->load->model('logbooks_model');
$logbooks_locations_array = $CI->logbooks_model->list_logbook_relationships($this->session->userdata('active_station_logbook'));
$location_list = "'" . implode("','", $logbooks_locations_array) . "'";
if (empty($logbooks_locations_array)) {
return $this->db->query("SELECT * FROM " . $this->config->item('table_name') . " WHERE 1=0"); // Return empty result
}
$sql = "select * from " . $this->config->item('table_name') .
" where station_id in (" . $location_list . ")" .
" and (col_gridsquare like '" . $gridsquare . "%'
or col_vucc_grids like '%" . $gridsquare . "%')";
// Use parameterized query to prevent SQL injection
$this->db->select('*');
$this->db->from($this->config->item('table_name'));
$this->db->where_in('station_id', $logbooks_locations_array);
// Use parameterized LIKE queries for gridsquare matching
$gridsquare_like = $gridsquare . '%';
$gridsquare_contains = '%' . $gridsquare . '%';
$this->db->group_start();
$this->db->like('col_gridsquare', $gridsquare_like, 'after');
$this->db->or_like('col_vucc_grids', $gridsquare_contains);
$this->db->group_end();
if ($band != 'All') {
if ($band == 'SAT') {
$sql .= " and col_prop_mode ='" . $band . "'";
$this->db->where('col_prop_mode', $band);
} else {
$sql .= " and col_prop_mode !='SAT'";
$sql .= " and col_band ='" . $band . "'";
$this->db->where('col_prop_mode !=', 'SAT');
$this->db->where('col_band', $band);
}
}
return $this->db->query($sql);
return $this->db->get();
}
public function activator_details($call, $band, $leogeo)