#5609 Security enhancements

inc/classes/BxDolAccount.php

@@ -1128,6 +1128,8 @@ class BxDolAccount extends BxDolFactory implements iBxDolSingleton
         $iAccountId = (int)BxDolProfile::getInstance($iProfileId)->getAccountId();
         if(isAdmin($iAccountId) && $iAccountId == (int)$aContentInfo['id'])
             return _t('_sys_txt_account_cannot_delete');
+        if(!isAdmin($iAccountId) && $iAccountId != (int)$aContentInfo['id'])
+            return _t('_sys_txt_access_denied');
 
         $aCheck = checkActionModule($iProfileId, 'delete account', 'system', $isPerformAction);
         if ($aCheck[CHECK_ACTION_RESULT] !== CHECK_ACTION_RESULT_ALLOWED)

inc/classes/BxDolDb.php

@@ -1211,6 +1211,41 @@ class BxDolDb extends BxDolFactory implements iBxDolSingleton
         return trim($s, $sDiv);
     }
 
+    function isValidOperator(string $operator): bool
+    {
+        static $operators = [
+            // Comparison
+            '=', '!=', '<>', '<', '>', '<=', '>=',
+            '<=>',
+    
+            // Logical
+            'AND', 'OR', 'XOR', 'NOT',
+    
+            // Arithmetic
+            '+', '-', '*', '/', '%',
+            'DIV', 'MOD',
+    
+            // Bitwise
+            '&', '|', '^', '<<', '>>',
+    
+            // Other MySQL operators
+            'IS', 'IS NOT',
+            'LIKE', 'NOT LIKE',
+            'REGEXP', 'NOT REGEXP',
+            'IN', 'NOT IN',
+            'BETWEEN', 'NOT BETWEEN',
+    
+            // Custom functions/operators
+            'COUNT', 'LOCATE',
+            'EMPTY VALUE', 
+            'NOT EMPTY VALUE',
+            'NOTHING', 
+            'IN_SET',
+        ];
+    
+        return in_array(strtoupper(trim($operator)), $operators, true);
+    }
+
     protected function log($s)
     {
         if (defined('BX_DIRECTORY_PATH_LOGS')) {
@@ -1394,8 +1429,11 @@ class BxDolDb extends BxDolFactory implements iBxDolSingleton
             $aParamsSecret = $this->getColumn("SELECT `name` FROM `sys_options` WHERE `type`='secret'", "name");
             if($aParamsSecret && is_array($aParamsSecret))
                 array_walk($aParams, function(&$sValue, $sKey) use ($aParamsSecret) {
-                    if(in_array($sKey, $aParamsSecret))
+                    if(in_array($sKey, $aParamsSecret)) {
                         $sValue = bx_gen_secret($sValue);
+                    } elseif (mb_strlen($sValue) > 100) {
+                        $sValue = mb_substr($sValue, 0, 100) . '...';
+                    }
                 });
 
             $sOutput .= '<div><b>Settings:</b></div><div style="overflow:scroll;height:300px;border:1px solid gray;"><pre>' . htmlspecialchars_adv(var_export($aParams, true)) . '</pre></div>';

inc/classes/BxDolSearch.php

@@ -1258,11 +1258,14 @@ class BxDolSearchResult implements iBxDolReplaceable
                             $sqlCondition .= strtoupper($aValue['operator']) . '(' . $sValuesString . ')';
                             break;
                        case 'in_set':
-                           $sqlCondition = "1 << (" . $sqlCondition . " - 1) & " . (int)$aValue['value'];
-                           break;
+                            $sqlCondition = "1 << (" . $sqlCondition . " - 1) & " . (int)$aValue['value'];
+                            break;
                        default:
-                               $sqlCondition .= $aValue['operator'] . (isset($aValue['no_quote_value']) && $aValue['no_quote_value'] ?  $aValue['value'] : $oDb->escape($aValue['value']));
-                       break;
+                            if (!$oDb->isValidOperator($aValue['operator'])) {
+                                throw new Exception('Invalid operator in getRestriction method');
+                            }
+                            $sqlCondition .= $aValue['operator'] . (isset($aValue['no_quote_value']) && $aValue['no_quote_value'] ?  $aValue['value'] : $oDb->escape($aValue['value']));
+                            break;
                     }
                 }
                 if (strlen($sqlCondition) > 0)

inc/classes/BxDolSearchExtended.php

@@ -204,6 +204,9 @@ class BxDolSearchExtended extends BxDolFactory implements iBxDolFactoryObject
                     break;
 
                 default:
+                    if (!$oDb->isValidOperator($aSearchParam['operator'])) {
+                        throw new Exception('Invalid operator in processParams method');
+                    }
                     $sSearchValue = " " . $aSearchParam['operator'] . " :" . $sSearchParam;
 
                     $aQueryParts['bindings'][$sSearchParam] = $aSearchParam['value'];

modules/base/general/classes/BxBaseModGeneralDb.php

@@ -169,6 +169,9 @@ class BxBaseModGeneralDb extends BxDolModuleDb
         $sSql = "SELECT COUNT(*) FROM `" . $this->_oConfig->CNF['TABLE_ENTRIES'] . "` WHERE 1";
         
         foreach($aParams as $aValue){
+            if (!$this->isValidOperator($aValue['operator'])) {
+                throw new Exception('Invalid operator in getEntriesNumByParams method');
+            }
             $sSql .= ' AND `' . $aValue['key'] ."` " . $aValue['operator'] . " '" . $aValue['value'] . "'";
         }
         
@@ -680,6 +683,9 @@ class BxBaseModGeneralDb extends BxDolModuleDb
                     break;
 
                 default:
+                    if (!$this->isValidOperator($aSearchParam['operator'])) {
+                        throw new Exception('Invalid operator in _getEntriesBySearchIds method');
+                    }
                     $sSearchValue = " " . $aSearchParam['operator'] . " :" . $sSearchParam;
                     $aMethod['params'][1][$sSearchParam] = $aSearchParam['value'];
             }
@@ -737,8 +743,23 @@ class BxBaseModGeneralDb extends BxDolModuleDb
             );
 
         $aOrders = array();
-        foreach($aParams['search_params']['order'] as $aOrder) 
-            $aOrders[] = "`" . (isset($aOrder['table']) ? $aOrder['table'] : $CNF['TABLE_ENTRIES']) . "`.`" . (!empty($aOrder['field']) ? $aOrder['field'] : $CNF['FIELD_ADDED']) . "` " . (!empty($aOrder['direction']) ? strtoupper($aOrder['direction']) : 'DESC');
+        foreach($aParams['search_params']['order'] as $aOrder) {
+            $sTable = (isset($aOrder['table']) ? $aOrder['table'] : $CNF['TABLE_ENTRIES']);
+            $sField = $CNF['FIELD_ADDED'];
+            if (!empty($aOrder['field'])) {                
+                if (!$this->isFieldExists($sTable, $aOrder['field'])) {
+                    throw new Exception('Invalid field ' . $aOrder['field'] . ' in table ' . $sTable . ' in _getEntriesBySearchIdsOrder method');
+                }
+                $sField = $aOrder['field'];
+            }
+
+            $sDir = 'DESC';
+            if (!empty($aOrder['direction'])) {
+                $sDir = strtoupper($aOrder['direction']) == 'ASC' ? 'ASC' : 'DESC';
+            }
+
+            $aOrders[] = "`" . $sTable . "`.`" . $sField . "` " . $sDir;
+        }
 
         $sOrderClause .= implode(', ', $aOrders);
     }

modules/base/profile/classes/BxBaseModProfileDb.php

@@ -211,6 +211,9 @@ class BxBaseModProfileDb extends BxBaseModGeneralDb
             WHERE 1";
         
         foreach($aParams as $aValue){
+            if (!$this->isValidOperator($aValue['operator'])) {
+                throw new Exception('Invalid operator in getEntriesNumByParams method');
+            }
             $sSql .= ' AND ' . (isset($aValue['table'])? '`' . $aValue['table'] .'`.' : '') . '`' . $aValue['key'] ."` " . $aValue['operator'] . " '" . $aValue['value'] . "'";
         }
         

modules/boonex/accounts/classes/BxAccntDb.php

@@ -38,6 +38,9 @@ class BxAccntDb extends BxBaseModGeneralDb
         $sSql = "SELECT COUNT(*) FROM `sys_accounts` WHERE 1";
         
         foreach($aParams as $aValue){
+            if (!$this->isValidOperator($aValue['operator'])) {
+                throw new Exception('Invalid operator in getEntriesNumByParams method');
+            }
             $sSql .= ' AND ' . (isset($aValue['table'])? '`' . $aValue['table'] .'`.' : '') . '`' . $aValue['key'] ."` " . $aValue['operator'] . " '" . $aValue['value'] . "'";
         }
         

template/scripts/BxBaseSearchExtended.php

@@ -126,6 +126,9 @@ class BxBaseSearchExtended extends BxDolSearchExtended
             $aParamsSearch = $aParams[$sK];
 
         foreach($this->_aObject['fields'] as $aField) {
+            if (!BxDolDb::getInstance()->isValidOperator($aField['search_operator'])) {
+                throw new Exception('Invalid operator in foreach loop in getResults method');
+            }
             $mixedValue = $oForm->getCleanValue($aField['name']);
             if(empty($mixedValue) || (is_array($mixedValue) && bx_is_empty_array($mixedValue)))
                 continue;