Nhances/nhance
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FIX_SQL_INJECT2

Browse Source
This commit is contained in:
velz 2026-02-12 12:04:33 +05:30
parent cea1e0f42d
commit fa69f2780c
3 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
app/Config/Acl.php
View File

@ -36,6 +36,12 @@ class Acl
'teams' => [] 'teams' => []
], ],
// ===================== VIEW INCEPTION PAGE =====================
'#^/hrFileList#' => [
'roles' => [ ADMIN_ROLE_ID,HEAD_ROLE_ID, MANAGER_ROLE_ID, STAFF_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
'teams' => []
],
// ===================== USER MANAGEMENT ===================== // ===================== USER MANAGEMENT =====================
'#^/user#' => [ '#^/user#' => [
'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID], 'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID],

2
app/Controllers/EmployeeController.php
View File

@ -1905,7 +1905,7 @@ class EmployeeController extends AdminController
$query = " $query = "
UPDATE employee_polices UPDATE employee_polices
SET employee_polices.status = 'truncated', employee_polices.is_active = 0 SET employee_polices.status = 'truncated', employee_polices.is_active = 0
WHERE employee_polices.file_id == :file_id: WHERE employee_polices.file_id = :file_id:
"; ";
$binds = ["file_id" => $file_id]; $binds = ["file_id" => $file_id];

6
app/Controllers/VidalApiController.php
View File

@ -836,9 +836,9 @@ class VidalApiController extends BaseController
// log_message('error', "✅ Match found: emp_code={$row['empNo']} policy={$row['policyNumber']}"); // log_message('error', "✅ Match found: emp_code={$row['empNo']} policy={$row['policyNumber']}");
$sql = "UPDATE employee_polices $sql = "UPDATE employee_polices
SET tpa_id = ? SET tpa_id = :tpa_id:,
WHERE id = ?"; WHERE id = :emp_policy_id:";
$this->db->query($sql, [$row['enrollmentId'], $policy_data['emp_policy_id']]); $this->db->query($sql, ["tpa_id"=>$row['enrollmentId'], "emp_policy_id"=>$policy_data['emp_policy_id']]);
// for e-card send // for e-card send
if(strtolower(trim($policy_data['relationship'])) == 'self'){ if(strtolower(trim($policy_data['relationship'])) == 'self'){