[Fmsystem-commits] [14860] more on SQL-injection

[Sigurd Nes]

Revision: 14860
          http://svn.sv.gnu.org/viewvc/?view=rev&root=fmsystem&revision=14860
Author:   sigurdne
Date:     2016-03-25 12:37:00 +0000 (Fri, 25 Mar 2016)
Log Message:
-----------
more on SQL-injection

Modified Paths:
--------------
    trunk/phpgwapi/inc/class.db.inc.php

Modified: trunk/phpgwapi/inc/class.db.inc.php
===================================================================
--- trunk/phpgwapi/inc/class.db.inc.php 2016-03-23 13:44:44 UTC (rev 14859)
+++ trunk/phpgwapi/inc/class.db.inc.php 2016-03-25 12:37:00 UTC (rev 14860)
@@ -752,7 +752,7 @@
                                                $first_element = false;
                                                continue;
                                        }
-                                       
if(preg_match("/(\bUNION\b|\bPG_SLEEP\b|\bCHR\b|\bGENERATE_SERIES\b)/i", $sql))
+                                       if(preg_match("/(UNION 
ALL|\bPG_SLEEP\b|\bCHR\b|\bGENERATE_SERIES\b)/i", $sql))
                                        {
                                                $this->transaction_abort();
                                                trigger_error('Attempt on 
SQL-injection', E_USER_ERROR);