From 37b29231e47a0c4458dc1c15d98588f16f07e1e2 Mon Sep 17 00:00:00 2001 From: Marius Cramer <m.cramer@pixcept.de> Date: Thu, 06 Aug 2015 03:18:44 -0400 Subject: [PATCH] - don't set password via remoting if field is empty --- interface/web/tools/user_settings.php | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/interface/web/tools/user_settings.php b/interface/web/tools/user_settings.php index 02fc4f7..5754245 100644 --- a/interface/web/tools/user_settings.php +++ b/interface/web/tools/user_settings.php @@ -102,7 +102,7 @@ global $app; if($_POST['passwort'] != '') { - $tmp_user = $app->db->queryOneRecord("SELECT passwort FROM sys_user WHERE userid = '".$app->functions->intval($_SESSION['s']['user']['userid'])."'"); + $tmp_user = $app->db->queryOneRecord("SELECT passwort FROM sys_user WHERE userid = ?", $_SESSION['s']['user']['userid']); $_SESSION['s']['user']['passwort'] = $tmp_user['passwort']; unset($tmp_user); } -- Gitblit v1.9.1