security/core#59 - Fix SQL injection in civicrm/ajax/dedupefind

This fixes an SQL injection in civicrm/ajax/dedupefind by validating
the order direction parameter.

Fixes #59

diff --git a/CRM/Contact/Page/AJAX.php b/CRM/Contact/Page/AJAX.php
index 3ac0326cf743eecfef9239b012f5737c38486c86..056b9369013172b005287237f85262aec327aa18 100644 (file)
--- a/CRM/Contact/Page/AJAX.php
+++ b/CRM/Contact/Page/AJAX.php
@@ -724,7 +724,7 @@ LIMIT {$offset}, {$rowCount}
       foreach ($_REQUEST['order'] as $orderInfo) {
         if (!empty($orderInfo['column'])) {
           $orderColumnNumber = $orderInfo['column'];
-          $dir = $orderInfo['dir'];
+          $dir = CRM_Utils_Type::escape($orderInfo['dir'], 'MysqlOrderByDirection', FALSE);
         }
       }
       $columnDetails = CRM_Utils_Array::value($orderColumnNumber, $_REQUEST['columns']);