Changeset 6435

Timestamp:

06/06/12 11:16:36 (12 years ago)

Author:

cristiano

Message:

Ticket #2842 - Correção no tratamento de sessão de usuário logado

File:

• trunk/phpgwapi/inc/class.sessions.inc.php (modified) (3 diffs)

trunk/phpgwapi/inc/class.sessions.inc.php

@@ -594 +594 @@
                  */
                 function get_last_access_on_history($account_id) {
+                        
                         $GLOBALS['phpgw']->db->query("select li from phpgw_access_log where account_id='$account_id' order by li desc limit 1",__LINE__,__FILE__);
                         if(!$GLOBALS['phpgw']->db->next_record())
@@ -619 +620 @@
                                 }
                                 $GLOBALS['phpgw']->db->query('INSERT INTO phpgw_access_log(sessionid,loginid,ip,li,lo,account_id,browser)'
-                                        . " VALUES ('" . $sessionid . "','" . $this->db->db_addslashes($login). "','"
-                                        . $this->db->db_addslashes($user_ip) . "',$now,0," . (int)$account_id .",'".$this->db->db_addslashes(substr($_SERVER[ 'HTTP_USER_AGENT' ],0,199))."')",__LINE__,__FILE__);
+                                        . " VALUES ('" . pg_escape_string($sessionid) . "','" . pg_escape_string($login). "','"
+                                        . pg_escape_string($user_ip) . "',$now,0," .  (int)$account_id .",'".pg_escape_string(substr($_SERVER[ 'HTTP_USER_AGENT' ],0,199))."')",__LINE__,__FILE__);
                         }
                         else if($sessionid != 'bad login or password')
                         {
                                 $GLOBALS['phpgw']->db->query("UPDATE phpgw_access_log SET lo=" . $now . " WHERE sessionid='"
-                                        . $sessionid . "'",__LINE__,__FILE__);
+                                        . pg_escape_string($sessionid) . "'",__LINE__,__FILE__);
                         }
 
@@ -662 +663 @@
                         }
                         */
-                        $login = $this->db->db_addslashes($login);
+                        $login = pg_escape_string($login);
                         $this->db->query("SELECT count(*) FROM phpgw_access_log WHERE account_id=0 AND (loginid='$login' OR loginid LIKE '$login@%') AND li > $block_time",__LINE__,__FILE__);
                         $this->db->next_record();