From 4fed33db3385486ca88383ac7426b958a47532fa Mon Sep 17 00:00:00 2001 From: Dany De Bontridder Date: Sun, 8 Oct 2017 14:39:44 +0200 Subject: [PATCH] Security : SQL use directly $_SESSION --- include/class/acc_ledger.class.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/class/acc_ledger.class.php b/include/class/acc_ledger.class.php index bbb9dcfa1..e5ba14516 100644 --- a/include/class/acc_ledger.class.php +++ b/include/class/acc_ledger.class.php @@ -2934,7 +2934,7 @@ class Acc_Ledger extends jrn_def_sql { $fil_sec = $and . " jr_def_id in ( select uj_jrn_id " . " from user_sec_jrn where " . - " uj_login='" . $_SESSION['g_user'] . "'" . + " uj_login='" .sql_string($_SESSION['g_user']) . "'" . " and uj_priv in ('R','W'))"; } $where = $fil_ledger . $fil_amount . $fil_date . $fil_desc . $fil_sec . $fil_amount . $fil_qcode . $fil_paid . $fil_account.$fil_date_paid;