[Noalyss-commit] [noalyss] 74/219: Security : SQL use directly $_SESSION

[Dany De Bontridder]

sparkyx pushed a commit to branch master
in repository noalyss.

commit 4fed33db3385486ca88383ac7426b958a47532fa
Author: Dany De Bontridder <address@hidden>
Date:   Sun Oct 8 14:39:44 2017 +0200

    Security : SQL use directly $_SESSION
---
 include/class/acc_ledger.class.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/class/acc_ledger.class.php 
b/include/class/acc_ledger.class.php
index bbb9dcf..e5ba145 100644
--- a/include/class/acc_ledger.class.php
+++ b/include/class/acc_ledger.class.php
@@ -2934,7 +2934,7 @@ class Acc_Ledger extends jrn_def_sql
                {
                        $fil_sec = $and . " jr_def_id in ( select uj_jrn_id " .
                                        " from user_sec_jrn where " .
-                                       " uj_login='" . $_SESSION['g_user'] . 
"'" .
+                                       " uj_login='" 
.sql_string($_SESSION['g_user']) . "'" .
                                        " and uj_priv in ('R','W'))";
                }
                $where = $fil_ledger . $fil_amount . $fil_date . $fil_desc . 
$fil_sec . $fil_amount . $fil_qcode . $fil_paid . $fil_account.$fil_date_paid;