Astral04/studiobeve.no
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security hardening: fix SQLi, XSS, file upload, and migrate DB to RDS

Browse Source 
- Fix all SQL injection vulnerabilities across Service_model, User_model,
  Module_model, Log_model, and Admin controller using parameterized queries
- Add htmlspecialchars() to all user-controlled output in admin views
  (bookings, services, workers, service categories, login form)
- Fix XSS in AJAX worker response and manage-booking-cancelled view
- Add file extension whitelist (jpg, jpeg, png, gif, webp) to all uploads
- Remove webshell (pentest2.php) from assets/img/profiles/
- Stop logging plaintext passwords on failed login attempts
- Migrate database.php hostname from localhost to AWS RDS endpoint
- Fix dropdown styling (white-on-white) in worker calendar view

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Ubuntu
2026-05-07 13:00:32 +00:00
co-authored by Claude Opus 4.6
parent 307f17faa6
commit 420bcb37fd
20 changed files with 205 additions and 194 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/controllers/Admin.php
+21 -13
View File
@@ -167,7 +167,7 @@ class Admin extends CI_Controller {
$this->load->database();
$worker_id = $_GET['worker_id'];
$data['selectedWorkerId'] = $worker_id;
$data['schedule'] = $this->db->query("SELECT * FROM worker_schedule WHERE worker_id = '$worker_id'")->result();
$data['schedule'] = $this->db->query("SELECT * FROM worker_schedule WHERE worker_id = ?", array($worker_id))->result();
}
$this->load->view('admin/worker_schedule', $data);
@@ -580,17 +580,21 @@ class Admin extends CI_Controller {
$target_dir = getcwd()."/assets/img/";
$target_file = $target_dir . 'worker_'.str_replace(' ','_', $_POST['worker_name']);
$imageFileType = strtolower(pathinfo(basename($_FILES["worker_img"]["name"]),PATHINFO_EXTENSION));
if (move_uploaded_file($_FILES["worker_img"]["tmp_name"], $target_file.'.'.$imageFileType)) {
$allowedTypes = array('jpg', 'jpeg', 'png', 'gif', 'webp');
if (!in_array($imageFileType, $allowedTypes)) {
$data['message'] = 'Csak képfájlok engedélyezettek (jpg, png, gif, webp)!';
$data['message_class'] = 'errorMessage';
} elseif (move_uploaded_file($_FILES["worker_img"]["tmp_name"], $target_file.'.'.$imageFileType)) {
$data['message'] = 'A profilkép sikeresen feltöltve!';
$data['message_class'] = 'successMessage';
$data['worker_img'] = 'worker_'.str_replace(' ','_', $_POST['worker_name']).'.'.$imageFileType;
$data['message_class'] = 'successMessage';
$data['worker_img'] = 'worker_'.str_replace(' ','_', $_POST['worker_name']).'.'.$imageFileType;
} else {
$data['message'] = 'Hiba a feltöltés közben!';
$data['message_class'] = 'errorMessage';
$data['message_class'] = 'errorMessage';
}
}
$workerArray = array(
@@ -628,18 +632,22 @@ class Admin extends CI_Controller {
$target_dir = getcwd()."/assets/img/";
$target_file = $target_dir . 'worker_'.str_replace(' ','_', $_POST['worker_name']);
$imageFileType = strtolower(pathinfo(basename($_FILES["worker_img"]["name"]),PATHINFO_EXTENSION));
if (move_uploaded_file($_FILES["worker_img"]["tmp_name"], $target_file.'.'.$imageFileType)) {
$allowedTypes = array('jpg', 'jpeg', 'png', 'gif', 'webp');
if (!in_array($imageFileType, $allowedTypes)) {
$data['message'] = 'Csak képfájlok engedélyezettek (jpg, png, gif, webp)!';
$data['message_class'] = 'errorMessage';
} elseif (move_uploaded_file($_FILES["worker_img"]["tmp_name"], $target_file.'.'.$imageFileType)) {
$data['message'] = 'A profilkép sikeresen feltöltve!';
$data['message_class'] = 'successMessage';
$data['worker_img'] = 'worker_'.str_replace(' ','_', $_POST['worker_name']).'.'.$imageFileType;
$data['message_class'] = 'successMessage';
$data['worker_img'] = 'worker_'.str_replace(' ','_', $_POST['worker_name']).'.'.$imageFileType;
$workerArray = array(
'worker_profile_img' => $data['worker_img']
);
$this->Log_model->addLog('workers', $data['currentUser']->username.' profilképet állított be a(z) '.$_POST['worker_name'].' nevű dolgozóhoz', $data['currentUser']->username);
$this->Service_model->updateWorker($_POST['worker_id'], $workerArray);
} else {
$data['message'] = 'Hiba a feltöltés közben!';
$data['message_class'] = 'errorMessage';