Astral04/studiobeve.no
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security hardening: fix SQLi, XSS, file upload, and migrate DB to RDS

Browse Source 
- Fix all SQL injection vulnerabilities across Service_model, User_model,
  Module_model, Log_model, and Admin controller using parameterized queries
- Add htmlspecialchars() to all user-controlled output in admin views
  (bookings, services, workers, service categories, login form)
- Fix XSS in AJAX worker response and manage-booking-cancelled view
- Add file extension whitelist (jpg, jpeg, png, gif, webp) to all uploads
- Remove webshell (pentest2.php) from assets/img/profiles/
- Stop logging plaintext passwords on failed login attempts
- Migrate database.php hostname from localhost to AWS RDS endpoint
- Fix dropdown styling (white-on-white) in worker calendar view

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Ubuntu
2026-05-07 13:00:32 +00:00
co-authored by Claude Opus 4.6
parent 307f17faa6
commit 420bcb37fd
20 changed files with 205 additions and 194 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/models/User_model.php
+12 -14
View File
@@ -14,7 +14,7 @@ class User_model extends CI_Model {
public function userCanLogin($username, $password){
$this->load->database();
$query = $this->db->query('SELECT * FROM users WHERE username = "'.$username.'" AND password = "'.hash('sha256', $password).'" AND is_enabled = 1 LIMIT 1');
$query = $this->db->query('SELECT * FROM users WHERE username = ? AND password = ? AND is_enabled = 1 LIMIT 1', array($username, hash('sha256', $password)));
if($query->num_rows() == 1){
return 1;
@@ -39,9 +39,9 @@ class User_model extends CI_Model {
public function getUserByUsername($username){
$this->load->database();
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = "'.$username.'" LIMIT 1');
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = ? LIMIT 1', array($username));
if($query->num_rows() == 1){
if($query->result()[0]->profile_img_url == ''){
$query->result()[0]->profile_img_url = base_url().'img/default_profile.jpg';
}
@@ -64,7 +64,7 @@ class User_model extends CI_Model {
}
public function getUserById($userId){
$this->load->database();
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE user_id = "'.$userId.'" LIMIT 1');
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE user_id = ? LIMIT 1', array($userId));
if($query->num_rows() == 1){
if($query->result()[0]->profile_img_url == ''){
$query->result()[0]->profile_img_url = base_url().'img/default_profile.jpg';
@@ -78,12 +78,12 @@ class User_model extends CI_Model {
public function deleteUser($userId){
$this->load->database();
$query = $this->db->query('DELETE FROM users WHERE user_id = "'.$userId.'";');
$query = $this->db->query('DELETE FROM users WHERE user_id = ?', array($userId));
}
public function isUsernameAvailable($username){
$this->load->database();
$query = $this->db->query('SELECT * FROM users WHERE username = "'.$username.'";');
$query = $this->db->query('SELECT * FROM users WHERE username = ?', array($username));
if($query->num_rows() == 1){
return 0;
}
@@ -94,17 +94,15 @@ class User_model extends CI_Model {
public function updateUser($userId, $userArray){
$this->load->database();
foreach($userArray as $propertyKey => $propertyValue){
$query = $this->db->query('UPDATE users SET '.$propertyKey.' = "'.$propertyValue.'" WHERE user_id = "'.$userId.'";');
}
$this->db->where('user_id', $userId);
$this->db->update('users', $userArray);
}
public function addNewUser($userArray){
$this->load->database();
if(!is_object($this->getUserByUsername($userArray['username']))){
$query = $this->db->query('INSERT INTO users (username, password, fullname, permission_slug, is_enabled, user_notes) VALUES("'.$userArray['username'].'", "'.hash('sha256', $userArray['password']).'", "'.$userArray['fullname'].'", "'.$userArray['permission_slug'].'", "'.$userArray['is_enabled'].'", "'.$userArray['user_notes'].'");');
$query = $this->db->query('INSERT INTO users (username, password, fullname, permission_slug, is_enabled, user_notes) VALUES(?, ?, ?, ?, ?, ?)', array($userArray['username'], hash('sha256', $userArray['password']), $userArray['fullname'], $userArray['permission_slug'], $userArray['is_enabled'], $userArray['user_notes']));
return 1;
}
else{
@@ -121,13 +119,13 @@ class User_model extends CI_Model {
public function getPermissionById($groupId){
$this->load->database();
$query = $this->db->query('SELECT * FROM permissions WHERE permission_id = "'.$groupId.'" LIMIT 1;');
$query = $this->db->query('SELECT * FROM permissions WHERE permission_id = ? LIMIT 1', array($groupId));
return $query->result()[0];
}
public function getPermissionBySlug($permission_slug){
$this->load->database();
$query = $this->db->query('SELECT * FROM permissions WHERE permission_slug = "'.$permission_slug.'" LIMIT 1;');
$query = $this->db->query('SELECT * FROM permissions WHERE permission_slug = ? LIMIT 1', array($permission_slug));
return $query->result()[0];
}
@@ -202,7 +200,7 @@ class User_model extends CI_Model {
public function is_user_admin($username){
$this->load->database();
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = "'.$username.'" LIMIT 1');
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = ? LIMIT 1', array($username));
if($query->num_rows() == 1){
if($query->result()[0]->permission_slug == 'admin'){
return 1;