midsuit
/
core-jgi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

IDEMPIERE-1151 Vulnerability on Sequence Window

This commit is contained in:
Carlos Ruiz 2013-08-27 16:21:13 -05:00
parent f9e6dbbea5
commit c5d9ae51b8
1 changed files with 20 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
org.adempiere.base/src/org/compiere/util/Env.java
View File

@ -1474,18 +1474,29 @@ public final class Env
} else if (po != null) { } else if (po != null) {
//take from po //take from po
Object v = po.get_Value(token); Object v = po.get_Value(token);
MColumn colToken = MColumn.get(ctx, po.get_TableName(), token);
String foreignTable = colToken.getReferenceTableName();
if (v != null) { if (v != null) {
if (format != null && format.length() > 0) { if (format != null && format.length() > 0) {
if (v instanceof Integer && token.endsWith("_ID")) { if (v instanceof Integer && (Integer) v > 0 && token.endsWith("_ID")) {
int tblIndex = format.indexOf("."); int tblIndex = format.indexOf(".");
String table = tblIndex > 0 ? format.substring(0, tblIndex) : token.substring(0, token.length() - 3); String tableName = null;
String column = tblIndex > 0 ? format.substring(tblIndex + 1) : format; if (tblIndex > 0)
MColumn col = MColumn.get(ctx, table, column); tableName = format.substring(0, tblIndex);
if (col != null && col.isSecure()) { else
outStr.append("********"); tableName = foreignTable;
} else { MTable table = MTable.get(ctx, tableName);
outStr.append(DB.getSQLValueString(trxName, if (table != null && tableName.equalsIgnoreCase(foreignTable)) {
"SELECT " + column + " FROM " + table + " WHERE " + table + "_ID = ?", (Integer)v)); String columnName = tblIndex > 0 ? format.substring(tblIndex + 1) : format;
MColumn column = table.getColumn(columnName);
if (column != null) {
if (column.isSecure()) {
outStr.append("********");
} else {
outStr.append(DB.getSQLValueString(trxName,
"SELECT " + columnName + " FROM " + tableName + " WHERE " + tableName + "_ID = ?", (Integer)v));
}
}
} }
} else if (v instanceof Date) { } else if (v instanceof Date) {
SimpleDateFormat df = new SimpleDateFormat(format); SimpleDateFormat df = new SimpleDateFormat(format);