xBeaTz/anjuma-dashboard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: replace raw SQL queries with prepared statements in Data.class.php

Browse Source 
- 15 methods migrated from query() to prepare()+execute()
- changeTermin() now uses column whitelist (11 allowed columns)
- setTerminStatus() delegates to changeTermin()
- Added ?: null fallbacks and type hints
- Consistent pattern across all database methods
This commit is contained in:
xBeaTz
2026-07-22 01:37:21 +02:00
parent 124f2746ac
commit 95b1db2309
1 changed files with 75 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Data.class.php
+75 -65
View File
@@ -26,24 +26,24 @@ class Data {
public function getDataByID($id, $column){ public function getDataByID($id, $column){
$sql = "SELECT * FROM users WHERE id = '" . $id . "'"; $stmt = $this->pdo->prepare("SELECT * FROM users WHERE id = :id");
foreach($this->pdo->query($sql) as $row) { $stmt->execute([':id' => $id]);
return $row[$column]; $row = $stmt->fetch(PDO::FETCH_ASSOC);
} return $row[$column] ?? null;
} }
public function getTerminDataById($id, $column){ public function getTerminDataById($id, $column){
$sql = "SELECT * FROM termine WHERE id = '" . $id . "'"; $stmt = $this->pdo->prepare("SELECT * FROM termine WHERE id = :id");
foreach($this->pdo->query($sql) as $row) { $stmt->execute([':id' => $id]);
return $row[$column]; $row = $stmt->fetch(PDO::FETCH_ASSOC);
} return $row[$column] ?? null;
} }
public function getSettingsData($column){ public function getSettingsData($column){
$sql = "SELECT * FROM settings_calendar WHERE id = '1'"; $stmt = $this->pdo->prepare("SELECT * FROM settings_calendar WHERE id = 1");
foreach($this->pdo->query($sql) as $row) { $stmt->execute();
return $row[$column]; $row = $stmt->fetch(PDO::FETCH_ASSOC);
} return $row[$column] ?? null;
} }
public function timestampToDate($timestamp){ public function timestampToDate($timestamp){
@@ -106,30 +106,29 @@ class Data {
} }
public function getOnlineStatusLabel($id){ public function getOnlineStatusLabel($id): string {
$sql = "SELECT * FROM users WHERE id = '" . $id . "'"; $stmt = $this->pdo->prepare("SELECT online FROM users WHERE id = :id");
foreach($this->pdo->query($sql) as $row) { $stmt->execute([':id' => $id]);
if($row['online'] == 0){ $online = $stmt->fetchColumn();
return "badge-danger";
}else{ if ($online === false) {
return "badge-success"; return "badge-secondary";
}
} }
return ((int)$online === 0) ? "badge-danger" : "badge-success";
} }
public function getTodoStatusLabel($id){ public function getTodoStatusLabel($id): string {
$sql = "SELECT * FROM todo WHERE id = '" . $id . "'"; $stmt = $this->pdo->prepare("SELECT status FROM todo WHERE id = :id");
foreach($this->pdo->query($sql) as $row) { $stmt->execute([':id' => $id]);
if($row['status'] == 0){ $status = $stmt->fetchColumn();
return "danger";
} return match ((int)$status) {
if($row['status'] == 1){ 0 => "danger",
return "warning"; 1 => "warning",
} 2 => "success",
if($row['status'] == 2){ default => "secondary",
return "success"; };
}
}
} }
private function getLastEditorInfo($terminId) private function getLastEditorInfo($terminId)
@@ -446,11 +445,20 @@ class Data {
public function changeTermin($id, $was, $value){ public function changeTermin($id, $was, $value): void {
$this->pdo->query("UPDATE termine SET $was = '" . $value . "' WHERE id = '" . $id . "'"); $allowed = [
//$this->updateCalendarEvent($id, $startzeit, $endzeit, $summary, $location, $beschreibung); 'startzeit', 'endzeit', 'location', 'locationtype',
'gage', 'anwesend', 'beschreibung', 'status',
'ansprechpartner', 'preisprostunde', 'realendzeit',
];
return; if (!in_array($was, $allowed, true)) {
throw new InvalidArgumentException("Ungültige Spalte: " . $was);
}
$sql = "UPDATE termine SET `" . $was . "` = :value WHERE id = :id";
$stmt = $this->pdo->prepare($sql);
$stmt->execute([':value' => $value, ':id' => $id]);
} }
private function icsEscape($text) private function icsEscape($text)
{ {
@@ -586,51 +594,53 @@ class Data {
public function setTerminStatus($id, $status){ public function setTerminStatus($id, $status): void {
$this->pdo->query("UPDATE termine SET status = '" . $status . "' WHERE id = '" . $id . "'"); $this->changeTermin($id, 'status', $status);
return;
} }
public function setTodoTitle($id, $title){ public function setTodoTitle($id, $title): void {
$this->pdo->query("UPDATE todo SET title = '" . $title . "' WHERE id = '" . $id . "'"); $stmt = $this->pdo->prepare("UPDATE todo SET title = :title WHERE id = :id");
return; $stmt->execute([':title' => $title, ':id' => $id]);
} }
public function setTodoDescription($id, $description){ public function setTodoDescription($id, $description): void {
$this->pdo->query("UPDATE todo SET description = '" . $description . "' WHERE id = '" . $id . "'"); $stmt = $this->pdo->prepare("UPDATE todo SET description = :desc WHERE id = :id");
return; $stmt->execute([':desc' => $description, ':id' => $id]);
} }
public function deleteTodoById($id){ public function deleteTodoById($id): void {
$this->pdo->query("DELETE FROM todo WHERE id = '" . $id . "'"); $stmt = $this->pdo->prepare("DELETE FROM todo WHERE id = :id");
return; $stmt->execute([':id' => $id]);
} }
public function createTodo($id, $title, $description){ public function createTodo($id, $title, $description): void {
$this->pdo->query("INSERT INTO todo (creator, title, description) VALUES ('" . $id . "', '" . $title . "', '" . $description . "')"); $stmt = $this->pdo->prepare("INSERT INTO todo (creator, title, description) VALUES (:creator, :title, :desc)");
return; $stmt->execute([':creator' => $id, ':title' => $title, ':desc' => $description]);
} }
public function getTodoDataById($id, $column){ public function getTodoDataById($id, $column){
$sql = "SELECT * FROM todo WHERE id = '" . $id . "'"; $stmt = $this->pdo->prepare("SELECT * FROM todo WHERE id = :id");
foreach($this->pdo->query($sql) as $row) { $stmt->execute([':id' => $id]);
return $row[$column]; $row = $stmt->fetch(PDO::FETCH_ASSOC);
} return $row[$column] ?? null;
} }
public function getAllReadyGigs(){ public function getAllReadyGigs(): int {
$nRows = $this->pdo->query('select count(*) from termine WHERE status = 1')->fetchColumn(); $stmt = $this->pdo->prepare("SELECT COUNT(*) FROM termine WHERE status = :status");
return $nRows; $stmt->execute([':status' => 1]);
return (int)$stmt->fetchColumn();
} }
public function getAllProcessingGigs(){ public function getAllProcessingGigs(): int {
$nRows = $this->pdo->query('select count(*) from termine WHERE status = 0')->fetchColumn(); $stmt = $this->pdo->prepare("SELECT COUNT(*) FROM termine WHERE status = :status");
return $nRows; $stmt->execute([':status' => 0]);
return (int)$stmt->fetchColumn();
} }
public function getAllCompletedGigs(){ public function getAllCompletedGigs(): int {
$nRows = $this->pdo->query('select count(*) from termine WHERE status = 2')->fetchColumn(); $stmt = $this->pdo->prepare("SELECT COUNT(*) FROM termine WHERE status = :status");
return $nRows; $stmt->execute([':status' => 2]);
return (int)$stmt->fetchColumn();
} }
private function debugLog($msg) { private function debugLog($msg) {