From 0dd27f2ac6499e6b5f7e8fcf6c809cea6b3740db Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Wed, 25 Mar 2026 13:37:28 +0100 Subject: [PATCH] Fix sanitize param groupby in customreport --- htdocs/core/customreports.php | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/htdocs/core/customreports.php b/htdocs/core/customreports.php index ca6e61e3b1c..ade6acb30fb 100644 --- a/htdocs/core/customreports.php +++ b/htdocs/core/customreports.php @@ -224,19 +224,20 @@ if ($action == 'viewgraph') { // $arrayofvaluesforgroupby will be used to forge lael of each grouped series if (is_array($search_groupby) && count($search_groupby)) { foreach ($search_groupby as $gkey => $gval) { - $gvalwithoutprefix = preg_replace('/^[a-z]+\./', '', $gval); + $gvalwithoutprefix = preg_replace('/^[a-z]+\./i', '', $gval); + $gvalsanitized = preg_replace('/[^a-z0-9\._\-]+/i', '', $gval); - if (preg_match('/\-year$/', $search_groupby[$gkey])) { - $tmpval = preg_replace('/\-year$/', '', $search_groupby[$gkey]); + if (preg_match('/\-year$/', $gvalsanitized)) { + $tmpval = preg_replace('/\-year$/', '', $gvalsanitized); $fieldtocount .= 'DATE_FORMAT('.$tmpval.", '%Y')"; - } elseif (preg_match('/\-month$/', $search_groupby[$gkey])) { - $tmpval = preg_replace('/\-month$/', '', $search_groupby[$gkey]); + } elseif (preg_match('/\-month$/', $gvalsanitized)) { + $tmpval = preg_replace('/\-month$/', '', $gvalsanitized); $fieldtocount .= 'DATE_FORMAT('.$tmpval.", '%Y-%m')"; - } elseif (preg_match('/\-day$/', $search_groupby[$gkey])) { - $tmpval = preg_replace('/\-day$/', '', $search_groupby[$gkey]); + } elseif (preg_match('/\-day$/', $gvalsanitized)) { + $tmpval = preg_replace('/\-day$/', '', $gvalsanitized); $fieldtocount .= 'DATE_FORMAT('.$tmpval.", '%Y-%m-%d')"; } else { - $fieldtocount = $search_groupby[$gkey]; + $fieldtocount = $gvalsanitized; } $sql = 'SELECT DISTINCT '.$fieldtocount.' as val';