HS-Esslingen/swb6-it-sec
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

sql injection in search

Browse source
This commit is contained in:
Florian Hoss 2022-04-07 21:06:30 +02:00
parent 7786e839b0
commit 4a07b461d3
3 changed files with 20 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

12
Lab01/app/webpage/webpage.go
View file

@ -38,11 +38,17 @@ func (wp *Webpage) defineRoutes() {
tasks := wp.Router.Group("/tasks")
{
tasks.GET("", func(c *gin.Context) {
if wp.isLoggedInMiddleware(c) {
username := c.Request.Header.Get("username")
tasks := wp.Database.GetAllTasks(username)
//if wp.isLoggedInMiddleware(c) { // FOR SQL INJECTION (username=Florian OR 1=1 in Header)
username := c.Request.Header.Get("username")
filter := c.Query("filter")
if filter != "" {
tasks := wp.Database.FilteredTasks(username, filter)
c.JSON(200, gin.H{"tasks": tasks})
return
}
tasks := wp.Database.GetAllTasks(username)
c.JSON(200, gin.H{"tasks": tasks})
//}
})
tasks.POST("", func(c *gin.Context) {
if wp.isLoggedInMiddleware(c) {