-
-
Notifications
You must be signed in to change notification settings - Fork 202
Stable 2.8.5 Build #3397
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Stable 2.8.5 Build #3397
Changes from all commits
Commits
Show all changes
20 commits
Select commit
Hold shift + click to select a range
b368cba
Enforce write permissions for QSO modifications
magicbug fb5afab
Remove strict type check in satellite name search
magicbug 6a8f8a8
Fix indentation for lotw_satellite_map comment block
magicbug 0c7b919
Update satellite mapping in lotw_satellite_map
magicbug 44fbfd4
Pass second parameter to getAdifLine in Logbook_model
magicbug e572821
Add Personal Propagation Advisor feature
magicbug 70cc096
Fix band row display logic in propagation advisor
magicbug d597e2e
Add DXCC statistics and continent breakdown
magicbug 1e7eb7d
Enhance country count filtering in statistics
magicbug 6080db9
Improve distances UI and add caching for statistics
magicbug f4d4fac
Optimize continent QSOs query in Awards controller
magicbug 218f796
Move filters section above statistics summary in DXCC view
magicbug 1fa6da4
Enhance CQ awards page with filters and table features
magicbug d07e788
Add WAS statistics summary, filters, and CSV export
magicbug bf82b69
Remove redundant statistics update calls in footer
magicbug 1000faf
Revert "Remove redundant statistics update calls in footer"
magicbug dd61dff
Fix null grid square handling for PHP 8 compatibility
magicbug 58d7eee
Redesign IOTA awards page UI and add search
magicbug cc1b92c
Fix DXCC ID assignment in logbook model
magicbug 4cf7d79
Add migration to tag Cloudlog as version 2.8.5
magicbug File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
SQL injection via improper escaping in continent query
High Severity
The
get_continent_qsos()function usesescape_like_str()to sanitize user input in a SQL equality comparison, but this function only escapes LIKE wildcards (%,_) and does not escape single quotes. This allows SQL injection via thecontinent_codePOST parameter. An attacker could send a value likeEU' OR '1'='1to bypass the intended WHERE clause. The correct approach would be to use$this->db->escape()or query binding with placeholders.