myron/tomsjavajive
1
0
Fork 0
mirror of https://github.com/myronblair/tomsjavajive synced 2026-07-28 01:02:35 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix critical unauthenticated order tampering/IDOR in api/orders.php and reused named-param bug in admin order search

Browse Source
This commit is contained in:
Myron Blair
2026-07-06 07:51:53 +00:00
parent 3c8e4d1dbc
commit f84a754370
2 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/orders.php
+4 -2
View File
@@ -45,8 +45,10 @@ if ($status) {
}
if ($search) {
$where[] = '(order_number LIKE :search OR customer_name LIKE :search OR customer_email LIKE :search)';
$params['search'] = '%' . $search . '%';
$where[] = '(order_number LIKE :search1 OR customer_name LIKE :search2 OR customer_email LIKE :search3)';
$params['search1'] = '%' . $search . '%';
$params['search2'] = '%' . $search . '%';
$params['search3'] = '%' . $search . '%';
}
if ($dateFrom) {