Astral04/studiobeve.no
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security hardening: fix SQLi, XSS, file upload, and migrate DB to RDS

Browse Source 
- Fix all SQL injection vulnerabilities across Service_model, User_model,
  Module_model, Log_model, and Admin controller using parameterized queries
- Add htmlspecialchars() to all user-controlled output in admin views
  (bookings, services, workers, service categories, login form)
- Fix XSS in AJAX worker response and manage-booking-cancelled view
- Add file extension whitelist (jpg, jpeg, png, gif, webp) to all uploads
- Remove webshell (pentest2.php) from assets/img/profiles/
- Stop logging plaintext passwords on failed login attempts
- Migrate database.php hostname from localhost to AWS RDS endpoint
- Fix dropdown styling (white-on-white) in worker calendar view

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Ubuntu
2026-05-07 13:00:32 +00:00
co-authored by Claude Opus 4.6
parent 307f17faa6
commit 420bcb37fd
20 changed files with 205 additions and 194 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/models/Log_model.php
+1 -1
View File
@@ -7,7 +7,7 @@ class Log_model extends CI_Model {
public function addLog($eventType, $eventContent, $username=""){
$this->load->database();
$query = $this->db->query("INSERT INTO system_log(event_type, event_content, username) VALUES('".$eventType."','".$eventContent."','".$username."');");
$query = $this->db->query("INSERT INTO system_log(event_type, event_content, username) VALUES(?, ?, ?)", array($eventType, $eventContent, $username));
}
public function getAllLoginfo(){
application/models/Module_model.php
+11 -6
View File
@@ -13,13 +13,13 @@ class Module_model extends CI_Model {
public function getModuleById($module_id){
$this->load->database();
$query = $this->db->query('SELECT * FROM modules WHERE module_id = "'.$module_id.'" LIMIT 1;');
$query = $this->db->query('SELECT * FROM modules WHERE module_id = ? LIMIT 1', array($module_id));
return $query->result()[0];
}
public function getModuleBySlug($module_slug){
$this->load->database();
$query = $this->db->query('SELECT * FROM modules WHERE module_slug = "'.$module_slug.'" LIMIT 1;');
$query = $this->db->query('SELECT * FROM modules WHERE module_slug = ? LIMIT 1', array($module_slug));
return $query->result()[0];
}
@@ -145,11 +145,16 @@ public function is_groupId_available_in_module($module_id, $groupId){
public function updateModule($fieldName, $module_id, $moduleUserArray){
$this->load->database();
$allowedFields = array('permission_group_ids', 'permission_ids');
if (!in_array($fieldName, $allowedFields)) return;
if(!empty($moduleUserArray)){
$query = $this->db->query("UPDATE modules SET ".$fieldName." ='".serialize($moduleUserArray)."' WHERE module_id = '".$module_id."';");
$this->db->where('module_id', $module_id);
$this->db->update('modules', array($fieldName => serialize($moduleUserArray)));
}
else{
$query = $this->db->query("UPDATE modules SET ".$fieldName." ='' WHERE module_id = '".$module_id."';");
$this->db->where('module_id', $module_id);
$this->db->update('modules', array($fieldName => ''));
}
}
@@ -174,7 +179,7 @@ public function getModulesByPermissionSlug($permissionSlug){
public function getPermissionBySlug($permissionSlug){
$this->load->database();
$query = $this->db->query('SELECT * FROM permissions WHERE permission_slug = "'.$permissionSlug.'";');
$query = $this->db->query('SELECT * FROM permissions WHERE permission_slug = ?', array($permissionSlug));
if($query->num_rows() == 1){
return $query->result()[0];
}
@@ -188,7 +193,7 @@ public function user_can_access_this_module($moduleSlug, $userId){
$this->load->model('User_model');
$selectedUser = $this->User_model->getUserById($userId);
$query = $this->db->query('SELECT * FROM modules WHERE module_slug = "'.$moduleSlug.'" LIMIT 1;');
$query = $this->db->query('SELECT * FROM modules WHERE module_slug = ? LIMIT 1', array($moduleSlug));
if($query->num_rows() == 1){
$result = $query->result()[0];
application/models/Service_model.php
+80 -86
View File
@@ -8,10 +8,10 @@ class Service_model extends CI_Model {
public function createService($serviceArray){
$this->load->database();
$query = $this->db->query('INSERT INTO services (
service_type,
service_category_no,
service_category_en,
service_category_hu,
service_type,
service_category_no,
service_category_en,
service_category_hu,
service_name_no,
service_name_en,
service_name_hu,
@@ -22,76 +22,70 @@ class Service_model extends CI_Model {
service_time,
service_category_id,
is_enabled
) VALUES(
"'.$serviceArray['service_type'].'",
"'.$serviceArray['service_category_no'].'",
"'.$serviceArray['service_category_en'].'",
"'.$serviceArray['service_category_hu'].'",
"'.$serviceArray['service_name_no'].'",
"'.$serviceArray['service_name_en'].'",
"'.$serviceArray['service_name_hu'].'",
"'.$serviceArray['service_description_no'].'",
"'.$serviceArray['service_description_en'].'",
"'.$serviceArray['service_description_hu'].'",
"'.$serviceArray['service_price'].'",
"'.$serviceArray['service_time'].'",
"'.$serviceArray['service_category_id'].'",
"'.$serviceArray['is_enabled'].'"
);');
) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', array(
$serviceArray['service_type'],
$serviceArray['service_category_no'],
$serviceArray['service_category_en'],
$serviceArray['service_category_hu'],
$serviceArray['service_name_no'],
$serviceArray['service_name_en'],
$serviceArray['service_name_hu'],
$serviceArray['service_description_no'],
$serviceArray['service_description_en'],
$serviceArray['service_description_hu'],
$serviceArray['service_price'],
$serviceArray['service_time'],
$serviceArray['service_category_id'],
$serviceArray['is_enabled']
));
}
public function createServiceCategory($serviceCategoryArray){
$this->load->database();
$query = $this->db->query('INSERT INTO service_categories (
serv_cat_slug,
serv_cat_slug,
serv_cat_name
) VALUES(
"'.$serviceCategoryArray['serv_cat_slug'].'",
"'.$serviceCategoryArray['serv_cat_name'].'"
);');
) VALUES(?, ?)', array(
$serviceCategoryArray['serv_cat_slug'],
$serviceCategoryArray['serv_cat_name']
));
}
public function updateService($service_id, $serviceArray){
$this->load->database();
foreach($serviceArray as $propertyKey => $propertyValue){
$query = $this->db->query('UPDATE services SET '.$propertyKey.' = "'.$propertyValue.'" WHERE service_id = "'.$service_id.'";');
}
$this->db->where('service_id', $service_id);
$this->db->update('services', $serviceArray);
}
public function updateServiceCategory($service_category_id, $serviceCategoryArray){
$this->load->database();
foreach($serviceCategoryArray as $propertyKey => $propertyValue){
$query = $this->db->query('UPDATE service_categories SET '.$propertyKey.' = "'.$propertyValue.'" WHERE service_category_id = "'.$service_category_id.'";');
}
$this->db->where('service_category_id', $service_category_id);
$this->db->update('service_categories', $serviceCategoryArray);
}
public function createWorker($workerArray){
$this->load->database();
$query = $this->db->query('INSERT INTO workers (
worker_name,
worker_profile_img,
worker_name,
worker_profile_img,
worker_info,
is_beauty,
is_barber,
service_category_id
) VALUES(
"'.$workerArray['worker_name'].'",
"'.$workerArray['worker_profile_img'].'",
"'.$workerArray['worker_info'].'",
"'.$workerArray['is_beauty'].'",
"'.$workerArray['is_barber'].'",
"'.$workerArray['service_category_id'].'"
);');
) VALUES(?, ?, ?, ?, ?, ?)', array(
$workerArray['worker_name'],
$workerArray['worker_profile_img'],
$workerArray['worker_info'],
$workerArray['is_beauty'],
$workerArray['is_barber'],
$workerArray['service_category_id']
));
}
public function updateWorker($worker_id, $workerArray){
$this->load->database();
foreach($workerArray as $propertyKey => $propertyValue){
$query = $this->db->query('UPDATE workers SET '.$propertyKey.' = "'.$propertyValue.'" WHERE worker_id = "'.$worker_id.'";');
}
$this->db->where('worker_id', $worker_id);
$this->db->update('workers', $workerArray);
}
public function updateBooking($booking_id, $bookingArray){
@@ -102,7 +96,7 @@ class Service_model extends CI_Model {
public function getAllServiceByServiceType($service_type, $lang){
$this->load->database();
$query = $this->db->query('SELECT * FROM services JOIN service_categories ON services.service_category_id = service_categories.service_category_id WHERE service_type = "'.$service_type.'" AND services.is_enabled = "1" AND services.is_deleted != "1" ORDER BY service_id ASC;');
$query = $this->db->query('SELECT * FROM services JOIN service_categories ON services.service_category_id = service_categories.service_category_id WHERE service_type = ? AND services.is_enabled = "1" AND services.is_deleted != "1" ORDER BY service_id ASC', array($service_type));
$serviceArray = array();
if($query->num_rows() > 0){
foreach($query->result() as $resultItem){
@@ -149,7 +143,7 @@ class Service_model extends CI_Model {
public function getServiceById($service_id){
$this->load->database();
$query = $this->db->query('SELECT * FROM services WHERE service_id = "'.$service_id.'" LIMIT 1;');
$query = $this->db->query('SELECT * FROM services WHERE service_id = ? LIMIT 1', array($service_id));
if($query->num_rows() > 0){
return $query->result()[0];
}
@@ -160,7 +154,7 @@ class Service_model extends CI_Model {
public function getServiceCategoryById($service_category_id){
$this->load->database();
$query = $this->db->query('SELECT * FROM service_categories WHERE service_category_id = "'.$service_category_id.'" LIMIT 1;');
$query = $this->db->query('SELECT * FROM service_categories WHERE service_category_id = ? LIMIT 1', array($service_category_id));
if($query->num_rows() > 0){
return $query->result()[0];
}
@@ -218,7 +212,7 @@ class Service_model extends CI_Model {
public function getWorkersByCategorySlug($serv_cat_slug){
$this->load->database();
$query = $this->db->query('SELECT * FROM workers JOIN service_categories ON workers.service_category_id = service_categories.service_category_id WHERE workers.is_deleted != "1" AND serv_cat_slug = "'.$serv_cat_slug.'" ORDER BY worker_name ASC;');
$query = $this->db->query('SELECT * FROM workers JOIN service_categories ON workers.service_category_id = service_categories.service_category_id WHERE workers.is_deleted != "1" AND serv_cat_slug = ? ORDER BY worker_name ASC', array($serv_cat_slug));
return $query->result();
}
@@ -242,7 +236,7 @@ class Service_model extends CI_Model {
public function deleteBooking($booking_id){
$this->load->database();
$query = $this->db->query('DELETE FROM bookings WHERE booking_id = "'.$booking_id.'";');
$query = $this->db->query('DELETE FROM bookings WHERE booking_id = ?', array($booking_id));
}
public function getAllBookings(){
@@ -337,7 +331,7 @@ class Service_model extends CI_Model {
$this->load->database();
$this->load->model('Service_model');
$query = $this->db->query('SELECT * FROM bookings JOIN workers ON bookings.worker_id = workers.worker_id WHERE booking_date >= CURDATE() AND bookings.worker_id = "'.$workerID.'" ORDER BY booking_date DESC, booking_start_time ASC;');
$query = $this->db->query('SELECT * FROM bookings JOIN workers ON bookings.worker_id = workers.worker_id WHERE booking_date >= CURDATE() AND bookings.worker_id = ? ORDER BY booking_date DESC, booking_start_time ASC', array($workerID));
if($query->num_rows() > 0){
$resultsArray = array();
@@ -381,7 +375,7 @@ class Service_model extends CI_Model {
$this->load->database();
$this->load->model('Service_model');
$query = $this->db->query('SELECT * FROM bookings WHERE booking_id = "'.$booking_id.'" LIMIT 1;');
$query = $this->db->query('SELECT * FROM bookings WHERE booking_id = ? LIMIT 1', array($booking_id));
if($query->num_rows() > 0){
return $query->result()[0];
}
@@ -392,7 +386,7 @@ class Service_model extends CI_Model {
public function getWorkerById($worker_id){
$this->load->database();
$query = $this->db->query('SELECT * FROM workers WHERE worker_id = "'.$worker_id.'" LIMIT 1;');
$query = $this->db->query('SELECT * FROM workers WHERE worker_id = ? LIMIT 1', array($worker_id));
if($query->num_rows() > 0){
return $query->result()[0];
}
@@ -430,9 +424,9 @@ class Service_model extends CI_Model {
// --- Override ellenőrzés ---
$overrideQuery = $this->db->query("
SELECT * FROM worker_schedule_overrides
WHERE worker_id = '$worker_id' AND date = '$selectedDate'
WHERE worker_id = ? AND date = ?
LIMIT 1
");
", array($worker_id, $selectedDate));
if ($overrideQuery->num_rows() > 0) {
$override = $overrideQuery->row();
@@ -448,13 +442,13 @@ class Service_model extends CI_Model {
$scheduleQuery = $this->db->query("
SELECT * FROM worker_schedule
WHERE worker_id = '{$worker_id}'
AND weekday = '{$weekday}'
WHERE worker_id = ?
AND weekday = ?
AND (
is_alternate_week = 0
OR (is_alternate_week = 1 AND " . ($isOddWeek ? "1" : "0") . ")
)
");
", array($worker_id, $weekday));
if ($scheduleQuery->num_rows() == 0) {
return [];
@@ -490,7 +484,7 @@ class Service_model extends CI_Model {
// --- Lunch break setup ---
// Pre-fetch all bookings for the day so we can do hypothetical checks per slot
$workerRow = $this->db->query("SELECT lunch_window_start, lunch_window_end, lunch_preferred_time FROM workers WHERE worker_id = '$worker_id' LIMIT 1")->row();
$workerRow = $this->db->query("SELECT lunch_window_start, lunch_window_end, lunch_preferred_time FROM workers WHERE worker_id = ? LIMIT 1", array($worker_id))->row();
$shiftSeconds = $finishTime->getTimestamp() - $dayStartTime->getTimestamp();
$lunchRequired = $workerRow && $workerRow->lunch_window_start && $workerRow->lunch_window_end && $shiftSeconds >= 6 * 3600;
@@ -498,8 +492,8 @@ class Service_model extends CI_Model {
if ($lunchRequired) {
$allBookings = $this->db->query("
SELECT booking_start_time, booking_finish_time FROM bookings
WHERE booking_date = '$selectedDate' AND worker_id = '$worker_id'
")->result();
WHERE booking_date = ? AND worker_id = ?
", array($selectedDate, $worker_id))->result();
}
$interval = new DateInterval('PT15M');
@@ -516,10 +510,10 @@ class Service_model extends CI_Model {
$bookingQuery = $this->db->query("
SELECT * FROM bookings
WHERE booking_date = '{$selectedDate}'
AND worker_id = '{$worker_id}'
AND booking_start_time < '{$endTimeStr}' AND booking_finish_time > '{$startTimeStr}'
");
WHERE booking_date = ?
AND worker_id = ?
AND booking_start_time < ? AND booking_finish_time > ?
", array($selectedDate, $worker_id, $endTimeStr, $startTimeStr));
if ($bookingQuery->num_rows() > 0) continue; // already booked
@@ -564,30 +558,30 @@ class Service_model extends CI_Model {
guest_confirmed,
guest_confirm_code,
manage_token
) VALUES(
'".$bookingArray['guest_name']."',
'".$bookingArray['guest_email']."',
'".$bookingArray['guest_phone']."',
'".$bookingArray['worker_id']."',
'".$bookingArray['booking_date']."',
'".$bookingArray['booking_start_time']."',
'".$bookingArray['booking_finish_time']."',
'".$bookingArray['service_ids']."',
'".$bookingArray['guest_confirmed']."',
'".$bookingArray['guest_confirm_code']."',
'".$bookingArray['manage_token']."'
);");
) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", array(
$bookingArray['guest_name'],
$bookingArray['guest_email'],
$bookingArray['guest_phone'],
$bookingArray['worker_id'],
$bookingArray['booking_date'],
$bookingArray['booking_start_time'],
$bookingArray['booking_finish_time'],
$bookingArray['service_ids'],
$bookingArray['guest_confirmed'],
$bookingArray['guest_confirm_code'],
$bookingArray['manage_token']
));
}
public function getBookingByToken($token){
$this->load->database();
$query = $this->db->query('SELECT * FROM bookings WHERE manage_token = "'.$this->db->escape_str($token).'" LIMIT 1;');
$query = $this->db->query('SELECT * FROM bookings WHERE manage_token = ? LIMIT 1', array($token));
return $query->num_rows() > 0 ? $query->result()[0] : false;
}
public function updateBookingCalEvents($booking_id, $worker_event_id, $owner_event_id){
$this->load->database();
$this->db->query("UPDATE bookings SET gcal_event_id_worker = '".$this->db->escape_str($worker_event_id)."', gcal_event_id_owner = '".$this->db->escape_str($owner_event_id)."' WHERE booking_id = '".$this->db->escape_str($booking_id)."';");
$this->db->query("UPDATE bookings SET gcal_event_id_worker = ?, gcal_event_id_owner = ? WHERE booking_id = ?", array($worker_event_id, $owner_event_id, $booking_id));
}
public function getWorkerSchedule($worker_id) {
@@ -789,14 +783,14 @@ class Service_model extends CI_Model {
$isOddWeek = $weekNumber % 2 !== 0;
$query = $this->db->query("
SELECT * FROM worker_schedule
WHERE worker_id = '{$worker_id}'
AND weekday = '{$weekday}'
SELECT * FROM worker_schedule
WHERE worker_id = ?
AND weekday = ?
AND (
is_alternate_week = 0
OR (is_alternate_week = 1 AND " . ($isOddWeek ? "1" : "0") . ")
)
");
", array($worker_id, $weekday));
return $query->num_rows() > 0;
}
application/models/User_model.php
+12 -14
View File
@@ -14,7 +14,7 @@ class User_model extends CI_Model {
public function userCanLogin($username, $password){
$this->load->database();
$query = $this->db->query('SELECT * FROM users WHERE username = "'.$username.'" AND password = "'.hash('sha256', $password).'" AND is_enabled = 1 LIMIT 1');
$query = $this->db->query('SELECT * FROM users WHERE username = ? AND password = ? AND is_enabled = 1 LIMIT 1', array($username, hash('sha256', $password)));
if($query->num_rows() == 1){
return 1;
@@ -39,9 +39,9 @@ class User_model extends CI_Model {
public function getUserByUsername($username){
$this->load->database();
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = "'.$username.'" LIMIT 1');
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = ? LIMIT 1', array($username));
if($query->num_rows() == 1){
if($query->result()[0]->profile_img_url == ''){
$query->result()[0]->profile_img_url = base_url().'img/default_profile.jpg';
}
@@ -64,7 +64,7 @@ class User_model extends CI_Model {
}
public function getUserById($userId){
$this->load->database();
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE user_id = "'.$userId.'" LIMIT 1');
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE user_id = ? LIMIT 1', array($userId));
if($query->num_rows() == 1){
if($query->result()[0]->profile_img_url == ''){
$query->result()[0]->profile_img_url = base_url().'img/default_profile.jpg';
@@ -78,12 +78,12 @@ class User_model extends CI_Model {
public function deleteUser($userId){
$this->load->database();
$query = $this->db->query('DELETE FROM users WHERE user_id = "'.$userId.'";');
$query = $this->db->query('DELETE FROM users WHERE user_id = ?', array($userId));
}
public function isUsernameAvailable($username){
$this->load->database();
$query = $this->db->query('SELECT * FROM users WHERE username = "'.$username.'";');
$query = $this->db->query('SELECT * FROM users WHERE username = ?', array($username));
if($query->num_rows() == 1){
return 0;
}
@@ -94,17 +94,15 @@ class User_model extends CI_Model {
public function updateUser($userId, $userArray){
$this->load->database();
foreach($userArray as $propertyKey => $propertyValue){
$query = $this->db->query('UPDATE users SET '.$propertyKey.' = "'.$propertyValue.'" WHERE user_id = "'.$userId.'";');
}
$this->db->where('user_id', $userId);
$this->db->update('users', $userArray);
}
public function addNewUser($userArray){
$this->load->database();
if(!is_object($this->getUserByUsername($userArray['username']))){
$query = $this->db->query('INSERT INTO users (username, password, fullname, permission_slug, is_enabled, user_notes) VALUES("'.$userArray['username'].'", "'.hash('sha256', $userArray['password']).'", "'.$userArray['fullname'].'", "'.$userArray['permission_slug'].'", "'.$userArray['is_enabled'].'", "'.$userArray['user_notes'].'");');
$query = $this->db->query('INSERT INTO users (username, password, fullname, permission_slug, is_enabled, user_notes) VALUES(?, ?, ?, ?, ?, ?)', array($userArray['username'], hash('sha256', $userArray['password']), $userArray['fullname'], $userArray['permission_slug'], $userArray['is_enabled'], $userArray['user_notes']));
return 1;
}
else{
@@ -121,13 +119,13 @@ class User_model extends CI_Model {
public function getPermissionById($groupId){
$this->load->database();
$query = $this->db->query('SELECT * FROM permissions WHERE permission_id = "'.$groupId.'" LIMIT 1;');
$query = $this->db->query('SELECT * FROM permissions WHERE permission_id = ? LIMIT 1', array($groupId));
return $query->result()[0];
}
public function getPermissionBySlug($permission_slug){
$this->load->database();
$query = $this->db->query('SELECT * FROM permissions WHERE permission_slug = "'.$permission_slug.'" LIMIT 1;');
$query = $this->db->query('SELECT * FROM permissions WHERE permission_slug = ? LIMIT 1', array($permission_slug));
return $query->result()[0];
}
@@ -202,7 +200,7 @@ class User_model extends CI_Model {
public function is_user_admin($username){
$this->load->database();
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = "'.$username.'" LIMIT 1');
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = ? LIMIT 1', array($username));
if($query->num_rows() == 1){
if($query->result()[0]->permission_slug == 'admin'){
return 1;