mag/WMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

M3 Security Fixes for pass 28

Browse Source
This commit is contained in:
Mark Gregory
2026-09-17 10:50:37 +01:00
parent 1037c1c202
commit ed3db89018
77 changed files with 82 additions and 2387 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Modules/M3/Http/Controllers/userControlController.php
-15
View File
@@ -76,7 +76,6 @@ class userControlController extends Controller
return 'success';
} else {
// echo "<script>alert('User profile entered does not exist, please try again');</script>";
// CL program call here (ewobjtst.)ICMUSRPRF parms(R428US, R428FIRST, R428FAMILY)
// connect to toolkit using DB2 credentials (can also leave blank for default authority)
@@ -100,7 +99,6 @@ class userControlController extends Controller
if (! $result) {
$PGMERRORS = self::PROGRAM_ERROR_PREFIX . $conn->getErrorCode() . self::MESSAGE_SEPARATOR . $conn->getErrorMsg();
// echo "<script>alert($PGMERRORS);</script>";
return 'error profile2';
} else {
// Successful Call : User profile created with default password
@@ -128,7 +126,6 @@ class userControlController extends Controller
public static function saveUserEdit(Request $request)
{
// dump($request);
if ($request->R428EMPCDE == '') {
$request->R428EMPCDE = 0;
}
@@ -149,7 +146,6 @@ class userControlController extends Controller
// Update record to ICM428M
$ICM428M = DB::connection(config('m3.connection', 'pgsql'))->select("select * from ICM428M where R428US='$request->R428US'");
// var_dump($ICM428M);
DB::connection(config('m3.connection', 'pgsql'))->update("update ICM428M
set R428CO='$request->R428CO', R428PL='$request->R428PL', R428WH='$request->R428WH', R428STS='$request->R428STS', R428FIRST='$request->R428FIRST',
@@ -197,7 +193,6 @@ class userControlController extends Controller
}
}
// $conn->setOptions(array('persistent' => false, 'stateless' => true, 'debug' => true,'debugLogFile' => '/www/sentm3test/htdocs/M3/storage/logs/toolkit_debug.log'));
// Add LIB
// $result = $conn->CLCommand('ADDLIBLE LIB(MPDAT10)');
@@ -214,12 +209,10 @@ class userControlController extends Controller
// Add Delivery Note Param
// $params[] = $conn->AddParameterPackDec('in', 11, 0, 'ParamIn','','00000087125');
// $params[] = $conn->AddParameterZoned('in', 11, 0, 'ParamIn');
// Start Time Tracking
// $start = microtime(true);
// dump('Calling: EWOBJ/ICMCHGPRF action='.$request->ACTION.' user='.$request->USERID);
// Config::get('eproconf.misc.PGM1'), Config::get('eproconf.misc.libname4')
// ICM700C EWOBJTST ICM700C ICM700CSBM
@@ -227,7 +220,6 @@ class userControlController extends Controller
if (! $result) {
$PGMERRORS = self::PROGRAM_ERROR_PREFIX . $conn->getErrorCode() . self::MESSAGE_SEPARATOR . $conn->getErrorMsg();
// dump($PGMERRORS);
echo "<script>alert($PGMERRORS);</script>";
return 'error';
@@ -235,7 +227,6 @@ class userControlController extends Controller
}
// Successful Call
else {
// dump($result);
// $AWREQN = $result['io_param']["var0"];
// return "success";
if ($request->ACTION == 'P') {
@@ -260,21 +251,18 @@ class userControlController extends Controller
public static function savePassword(Request $request)
{
// dd('B4');
ini_set('max_execution_time', Config::get('arrays.PHPTimeOut'));
ini_set('max_input_time', Config::get('arrays.PHPTimeOut'));
ini_set('default_socket_timeout', Config::get('arrays.PHPTimeOut'));
$PGMERRORS = '';
// console_log("request> ");
// echo "request="; var_dump($request);
// echo "B3<br>";
// connect to toolkit using DB2 credentials (can also leave blank for default authority)
try {
$conn = app(PostgresProgramBridge::class);
// dump($conn);
// echo "B4<br>";
} catch (\Throwable $e) {
// echo "B5<br>";
@@ -299,15 +287,12 @@ class userControlController extends Controller
}
}
// $params = [];
// $params[] = $conn->AddParameterChar('in', 10, 'userid','USRPRF',$request->USERID);
// $params[] = $conn->AddParameterChar('in', 10, 'pwd','PASSWORD',$request->PASSWORD);
// $params[] = $conn->AddParameterChar('in', 9, 'sts','STATUS','*ENABLED');
// $params[] = $conn->AddParameterChar('in', 4, 'pwdexp','PWDEXP','*NO');
// dump('Before CHGUSRPRF');
$result = $conn->CLCommand('QSYS/CHGUSRPRF USRPRF(' . $request->R428US_PWD . ') PASSWORD(' . $request->NEW_PASSWORD . ') STATUS(*ENABLED) PWDEXP(*NO)');
// $result = $conn->PgmCall('CHGUSRPRF', 'QSYS', $params, array(), array());
// echo "<script>alert('After CHGUSRPRF');</script>";
if (! $result) {