From 29aceee503d5fcaeb972950bc9827dd6ed41fa7b Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 2 Mar 2026 03:17:24 +0100 Subject: [PATCH] Complete fix of MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER --- htdocs/core/customreports.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/htdocs/core/customreports.php b/htdocs/core/customreports.php index 85b3f7e3349..ed51beba822 100644 --- a/htdocs/core/customreports.php +++ b/htdocs/core/customreports.php @@ -114,6 +114,9 @@ if (!defined('USE_CUSTOM_REPORT_AS_INCLUDE')) { } } +// In customreport context, we force the protection to avoid forging of criteria including bind SQL injection +$conf->global->MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER = 1; + if (empty($mode)) { $mode = 'graph'; }