smishchuk/svc-api-x
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

108 bookmark claen fix

Browse Source
This commit is contained in:
msyu
2025-05-16 17:15:05 +03:00
parent 381f5f1b4e
commit e4832ee878
6 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
v1/resources/instance_operation_cfs_subparam.cfc
+7 -7
View File
@@ -161,13 +161,13 @@
</cfif>
<cfquery name="local.qSave" result="local.result">
update instance_operation_cfs_subparam set
dt_updated=<cfqueryparam cfsqltype="cf_sql_timestamp" value="#Now()#" />
,updater_id=<cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.usrId#" />
,is_sensitive=<cfqueryparam cfsqltype="cf_sql_bit" value="#arguments.isSensitive#" />
,note=<cfqueryparam cfsqltype="cf_sql_varchar" value="#htmlEditFormat(arguments.note)#" /> <!--- *** XSS!!! --->
where instance_operation_cfs_param_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationCfsParamUid#" null=#!isValid('guid',arguments.instanceOperationCfsParamUid)#/>
AND iop.instance_operation_cfs_subparam=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.subparam#"/>
update instance_operation_cfs_subparam set
dt_updated=<cfqueryparam cfsqltype="cf_sql_timestamp" value="#Now()#" />
,updater_id=<cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.usrId#" />
,is_sensitive=<cfqueryparam cfsqltype="cf_sql_bit" value="#arguments.isSensitive#" />
,note=<cfqueryparam cfsqltype="cf_sql_varchar" value="#htmlEditFormat(arguments.note)#" /> <!--- *** XSS!!! --->
where instance_operation_cfs_param_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationCfsParamUid#" null=#!isValid('guid',arguments.instanceOperationCfsParamUid)#/>
AND iop.instance_operation_cfs_subparam=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.subparam#"/>
</cfquery>
<!--- *** проверить существование - 404 --->
<cfreturn noData().withStatus(204, "No Content") />