QA: Issue with SQL Injection Check

Cacti · Dec 23, 2024 · 9ca67c0 · 9ca67c0
1 parent 7c02f88
commit 9ca67c0
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/lib/api_automation.php b/lib/api_automation.php
@@ -1411,8 +1411,8 @@ function clearFilter() {
 		$sql_field = $item['field'] . ' AS source ';
 	} else {
 		$sql_field = '"SQL Injection" AS source ';
-		cacti_log('Attempted SQL Injection found in Tree Automation for the field variable.', false, 'AUTOM8');
-		raise_message('sql_injection', __('Attempted SQL Injection found in Tree Automation for the field variable.'), MESSAGE_LEVEL_ERROR);
+		cacti_log("Attempted SQL Injection found in Tree Automation for the field variable {$item['field']}.", false, 'AUTOM8');
+		raise_message('sql_injection', __("Attempted SQL Injection found in Tree Automation for the field variable {$item['field']}."), MESSAGE_LEVEL_ERROR);
 	}
 
 	/* now we build up a new query for counting the rows */
@@ -1509,7 +1509,7 @@ function clearFilter() {
 }
 
 function api_automation_column_exists($column, $tables) {
-	$column = str_replace(array('h.', 'ht.', 'gt.', 'gl.', 'gtg.'), '', 1);
+	$column = str_replace(array('h.', 'ht.', 'gt.', 'gl.', 'gtg.'), array('', '', '', '', ''), $column);
 
 	if (cacti_sizeof($tables)) {
 		foreach($tables as $table) {