FIX: Sanitize and bind SNMP Traps groups configuration 21.10.x (#11807)

centreon · Sep 21, 2022 · 8da2e2a · 8da2e2a
1 parent 8209330
commit 8da2e2a
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/www/include/configuration/configObject/traps-groups/DB-Func.php b/www/include/configuration/configObject/traps-groups/DB-Func.php
@@ -172,10 +172,12 @@ function insertTrapGroup($ret = array())
 
     $fields = array();
     if (isset($ret['traps'])) {
+        $query = "INSERT INTO traps_group_relation (traps_group_id, traps_id) VALUES (:traps_group_id, :traps_id)";
+        $statement = $pearDB->prepare($query);
         foreach ($ret['traps'] as $trap_id) {
-            $query = "INSERT INTO traps_group_relation (traps_group_id, traps_id) VALUES (" .
-                $pearDB->escape($trap_group_id['max_id']) . ",'" . $pearDB->escape($trap_id) . "')";
-            $pearDB->query($query);
+            $statement->bindValue(':traps_group_id', $trap_group_id['max_id'], \PDO::PARAM_INT);
+            $statement->bindValue(':traps_id', (int) $trap_id, \PDO::PARAM_INT);
+            $statement->execute();
         }
     }