Merge Develop #162
Merged
Merge Develop #162
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Chore: Update Github Workflow deps and PHP test version
Replace all string concatenation in SQL queries with prepared statements to prevent SQL injection attacks. Changes include: - actions/set_language.php: Fix critical $_GET['lng'] injection - actions/switch_profile.php: Fix 5 SQL injections with POST/session data - admin_connect.php: Fix search_id injections from GET/POST - actions/set_location.php: Fix 5 UPDATE queries with session variables - include/functions.php: Fix set_locale() and default_distance() with table name whitelist - include/db_mad.php: Fix gym ID injections in get_gym_by_id() and get_gym_url() - include/db_rdm.php: Fix gym ID injections in get_gym_by_id() and get_gym_url() - header.php: Fix 11 session-based queries throughout - admin_sync.php: Fix 3 queries with session IDs - actions/channel_sync.php: Add database name whitelist validation All queries now use mysqli prepared statements with bind_param() for user and session data. Table and database names use whitelist validation since they cannot be parameterized. Added explanatory comments for security patterns. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Replace string concatenation in SQL queries with prepared statements to prevent SQL injection attacks. These vulnerabilities are lower priority than the previous commit since they use $_SESSION['id'] rather than direct user input. However, a fault in authentication logic or a compromised identity provider could allow malicious values in $_SESSION['id'], leading to SQL injection. Changes include: - session.php: Fix $_SESSION['id'] injection when checking user database - modal/areas_modal.php: Fix 2 SQL injections with session data - modal/edit_profile_modal.php: Fix 3 SQL injections with session data - modal/distance_*_modal.php: Fix 7 distance query injections (pokemons, raids, gyms, invasions, lures, nests, quests) All queries now use mysqli prepared statements with bind_param() for defense in depth. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Convert all queries using session variables to prepared statements for defense in depth. Add integer validation for dynamic IN clauses from search functionality. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Convert queries to prepared statements in: - include/toplinks.php: UNION query with session variables - header.php: IV+PvP configuration check query - pages/display/dashboard.php: Count queries for all tracking types 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Convert all session variable queries to prepared statements in: - pages/display/raid.php: 3 queries (egg, raid level 9000, raid pokemon) - pages/display/quick_pick.php: 2 queries (clean, distance) - pages/display/quest.php: 5 queries (count + 4 reward types) - pages/display/nest.php: 1 query (nests listing) - pages/display/lure.php: 1 query (lures listing) - pages/display/invasion.php: 1 query (invasions listing) - pages/display/gym.php: 1 query (gyms listing) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Convert all session variable queries to prepared statements: - poracle_api.php: 1 query (admin list from $_SESSION['poracle_admins']) - quick_pick.php: 9 queries (100% IV, 0% IV, PvP rankings, Magikarp/Rattata weights, XXS/XXL sizes) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Fix critical SQL injection vulnerabilities
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.