Close SQL injection, command injection, and shell escaping gaps
fix: close SQL injection, command injection, and shell escaping gaps
Close SQL injection, command injection, and shell escaping gaps2de2ae-fix-close-sql-injection-command-injection-and-cve-2026-102608fixclose sql injection command shell escaping
Committed by connortechnology
commit message
fix: close SQL injection, command injection, and shell escaping gaps
FilterTerm.php:
- Use intval() on AlarmedZoneId value in SQL subquery to prevent
injection via crafted filter val
report_event_audit.php, montagereview.php:
- Cast $selected_monitor_ids through array_map('intval') before
interpolating into SQL IN clause (values come from $_REQUEST)
download_functions.php:
- Replace manual single-quoting with escapeshellarg() for merged
file name in ffmpeg, tar, and zip commands (monitor names can
contain shell metacharacters including single quotes)
- Same fix for export list file path
export_functions.php:
- Use escapeshellarg() on source and destination paths in cp -as
commands during event export
functions.php:
- Validate column keys in getFormChanges() against /^[a-zA-Z0-9_]+$/
to prevent SQL injection via crafted array keys from $_REQUEST
- Use dbEscape() and intval() for image/document MIME type and size
fields instead of raw string interpolation
- Replace escapeshellcmd() with escapeshellarg() in deletePath()
rm -rf command
Co-Authored-By: Claude Opus 4.6 <[email protected]>Editor assessment
This commit patches CVE-2026-102608. Excellent body: every sink is listed with its fix - intval on AlarmedZoneId, array_map for monitor IDs, escapeshellarg for ffmpeg/tar/zip and export paths, column-key validation, MIME sanitization, and escapeshellcmd replaced by escapeshellarg. The header is clean and needs no scope for this file-by-file hardening. The one missing synthesis is a sentence naming the shared root cause across the sinks; otherwise it is close to exemplary. The shared root cause is the missing synthesis; one sentence tying the sinks to unvalidated request input would complete the lesson.