fix: missing authentication check (#133)

docs: add security policy
2024-02-20 17:44:25 +01:00
parent 087f757248
commit b887d3a050
3 changed files with 41 additions and 1 deletions
@@ -17,7 +17,12 @@ if (!isset($_GET['paymentId']) || !isset($_GET['enabled'])) {

 $paymentId = $_GET['paymentId'];

-$inUse = $db->querySingle('SELECT COUNT(*) as count FROM subscriptions WHERE payment_method_id=' . $paymentId) === 1;
+$stmt = $db->prepare('SELECT COUNT(*) as count FROM subscriptions WHERE payment_method_id=:paymentId');
+$stmt->bindValue(':paymentId', $paymentId, SQLITE3_INTEGER);
+$result = $stmt->execute();
+$row = $result->fetchArray();
+$inUse = $row['count'] === 1;
+
 if ($inUse) {
    die(json_encode([
        "success" => false,