CVE-2025-59397

@@ -42,7 +42,7 @@
 define('OWA_PLUGIN_DIR', OWA_DIR.'plugins/');
 define('OWA_CONF_DIR', OWA_DIR.'conf/');
 define('OWA_THEMES_DIR', OWA_DIR.'themes/');
-define('OWA_VERSION', 'master');
+define('OWA_VERSION', '1.8.1');
 define('OWA_VENDOR_DIR', OWA_DIR.'vendor/');
 
 if ( file_exists( OWA_VENDOR_DIR . 'autoload.php' ) ) {

@@ -1,6 +1,6 @@
 {
   "name": "owa",
-  "version": "1.0.0",
+  "version": "1.8.1",
   "description": "Open Web Analytics is an open source alternative to commercial web analytics tools such as Google Analytics. This software allows you to stay in control of the data you collect about the user of your websites or applications.",
   "main": "index.js",
   "scripts": {

@@ -90,6 +90,43 @@ public static function escapeForDisplay($string, $encoding = 'UTF-8', $quotes =
         }
     }
 
+    /**
+     * Strip SQL keywords and punctuation to prevent SQL injection.
+     *
+     * @param string $input String to sanitize
+     * @return string Sanitized string
+     * @access public
+     * @static
+     */
+    public static function stripSql( $input = '' ) {
+   
+        if ( ! $input ) {
+            return $input;
+        }
+    
+        // Decode any encoded characters to reveal obfuscated SQL keywords.
+        $decoded = urldecode( $input );
+        $decoded = html_entity_decode( $decoded, ENT_QUOTES | ENT_HTML5, 'UTF-8' );
+       
+        // Remove common SQL command keywords.
+        $sql_keywords = array(
+            'select', 'insert', 'update', 'delete', 'drop', 'union', 'create',
+            'alter', 'truncate', 'replace', 'merge', 'call', 'exec'
+        );
+        $pattern = '/\\b(' . implode( '|', $sql_keywords ) . ')\\b/i';
+        $decoded = preg_replace( $pattern, '', $decoded );
+        
+        // Remove commas and parentheses except for our allowed values.
+        $allowed_values = ['(not set)', '(unknown)'];
+        if ( ! in_array( $input, $allowed_values ) ) {
+            $decoded = str_replace( array( ',', '(', ')' ), '', $decoded );              
+        }
+        
+        // Remove any encoded commas or parentheses that may remain.
+        $decoded = preg_replace( '/%2C|%28|%29|(|)|,/i', '', $decoded );
+    
+        return $decoded;
+    }
 
     /**
      * Strip Whitespace
@@ -327,8 +364,9 @@ public static function cleanUrl( $url ) {
                 'backslash'     => false
             )
         );
-
-        return trim(str_replace('&', '&', $url));
+        if ( $url ){
+            return trim(str_replace('&', '&', $url));
+        }
     }
 
     public static function cleanUserId ( $user_id ) {

@@ -17,7 +17,7 @@
 //
 
 require_once(OWA_BASE_DIR.'/owa_base.php');
-
+require_once(OWA_BASE_CLASS_DIR.'sanitize.php');
 /**
  * Database Connection Class
  * 
@@ -443,7 +443,7 @@ function generateSelectQuerySql() {
             // Add as
             if (!empty($v['as'])):
 
-                $cols .= ' as '.$v['as'];
+                $cols .= ' as '.$this->prepare( $v['as']);
 
             endif;
 
@@ -503,7 +503,7 @@ function _updateQuery() {
 
             endif;
 
-            $set .= $v['name'] .' = \'' . $this->prepare($v['value']) . '\'';
+            $set .= $this->prepare( $v['name'] ) .' = \'' . $this->prepare($v['value']) . '\'';
 
             $i++;
         }
@@ -574,35 +574,35 @@ function _makeConstraintClause( $type, $params ) {
             $constraint = $type.' ';
 
             foreach ($params as $k => $v) {
-
+                owa_coreAPI::debug($v);
                 switch (strtolower($v['operator'])) {
-
+                
                     case '==':
-                        $constraint .= sprintf("%s = '%s'",$v['name'], $this->prepare( $v['value'] ) );
+                        $constraint .= sprintf("%s = '%s'", $this->prepare( $v['name'] ), $this->prepare( $v['value'] ) );
                         break;
 
                     case 'between':
-                        $constraint .= sprintf("%s BETWEEN '%s' AND '%s'", $v['name'], $this->prepare( $v['value']['start'] ), $this->prepare( $v['value']['end'] ) );
+                        $constraint .= sprintf("%s BETWEEN '%s' AND '%s'", $this->prepare( $v['name'] ), $this->prepare( $v['value']['start'] ), $this->prepare( $v['value']['end'] ) );
                         break;
 
                     case '=~':
-                        $constraint .= sprintf("%s %s '%s'",$v['name'], OWA_SQL_REGEXP, $this->prepare( $v['value'] ) );
+                        $constraint .= sprintf("%s %s '%s'", $this->prepare( $v['name'] ), OWA_SQL_REGEXP, $this->prepare( $v['value'] ) );
                         break;
 
                     case '!~':
-                        $constraint .= sprintf("%s %s '%s'",$v['name'], OWA_SQL_NOTREGEXP, $this->prepare( $v['value'] ) );
+                        $constraint .= sprintf("%s %s '%s'",$this->prepare( $v['name'] ), OWA_SQL_NOTREGEXP, $this->prepare( $v['value'] ) );
                         break;
 
                     case '=@':
-                        $constraint .= sprintf("LOCATE('%s', %s) > 0",$v['value'], $this->prepare( $v['name'] ) );
+                        $constraint .= sprintf("LOCATE('%s', %s) > 0",$this->prepare( $v['value'] ), $this->prepare( $v['name'] ) );
                         break;
 
                     case '!@':
-                        $constraint .= sprintf("LOCATE('%s', %s) = 0",$v['value'], $this->prepare( $v['name'] ) );
+                        $constraint .= sprintf("LOCATE('%s', %s) = 0",$this->prepare( $v['value'] ), $this->prepare( $v['name'] ) );
                         break;
 
                     default:
-                        $constraint .= sprintf("%s %s '%s'",$v['name'], $v['operator'], $this->prepare( $v['value'] ) );
+                        $constraint .= sprintf("%s %s '%s'",$this->prepare( $v['name'] ), $v['operator'], $this->prepare( $v['value'] ) );
                         break;
                 }
 
@@ -641,7 +641,7 @@ function join($type, $table, $as, $foreign_key, $primary_key = '') {
 
     function prepare ( $string ) {
 
-        return $string;
+        return owa_sanitize::stripSql( $string );
     }
 
     function _makeJoinClause() {

@@ -297,7 +297,7 @@ function prepare( $string ) {
         if(is_null($string)){
             return $string;
         }
-
+        $string = owa_sanitize::stripSql( $string );
         if ($this->connection_status == false) {
               $this->connect();
           }