From 39977e2603fb52f9d2e80d91b08a8d7da0d5a256 Mon Sep 17 00:00:00 2001 From: Till Brehm Date: Thu, 29 Jun 2017 17:49:43 +0200 Subject: [PATCH] Fixed #4648 Insufficient privilege check in sites module --- interface/web/sites/ajax_get_json.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/interface/web/sites/ajax_get_json.php b/interface/web/sites/ajax_get_json.php index 913a81abf4..a3e54e8860 100644 --- a/interface/web/sites/ajax_get_json.php +++ b/interface/web/sites/ajax_get_json.php @@ -202,9 +202,9 @@ if ($type == 'getdirectivesnippet') { } if($type == 'getclientssldata'){ - $web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ?", $web_id); + $web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ? AND ".$app->tform->getAuthSQL('r'), $web_id); $sys_group = $app->db->queryOneRecord("SELECT * FROM sys_group WHERE groupid = ?", $web['sys_groupid']); - $client = $app->db->queryOneRecord("SELECT * FROM client WHERE client_id = ?", $sys_group['client_id']); + $client = $app->db->queryOneRecord("SELECT company_name,contact_firstname, contact_name, street, zip, city, telephone, mobile,fax, country, state, email FROM client WHERE client_id = ?",$sys_group['client_id']); if(is_array($client) && !empty($client)){ if($client['telephone'] == '' && $client['mobile'] != '') $client['telephone'] = $client['mobile']; -- GitLab