Merge pull request #122 from equinoxmatt/master

SQL Injection fix

Author: nabeelio

Diff for: core/common/Auth.class.php

@@ -255,8 +255,8 @@ public static function ProcessLogin($useridoremail, $password)
 			{
 				$emailaddress = DB::escape($useridoremail);
 				$sql = 'SELECT * FROM ' . TABLE_PREFIX . 'pilots
-						WHERE email=\''.$useridoremail.'\'';
-			} 
+						WHERE email=\''.$emailaddress.'\'';
+			}
 			# They're loggin in with a pilot id
 			elseif(preg_match('/^([A-Za-z]*)(.*)(\d*)/', $useridoremail, $matches)>0)
 			{
@@ -273,7 +273,7 @@ public static function ProcessLogin($useridoremail, $password)
 				return false;
 			}
 		}
-		
+
 		$password = DB::escape($password);
 		$userinfo = DB::get_row($sql);
 

Diff for: core/common/PilotData.class.php

@@ -951,7 +951,7 @@ public static function getPilotGroups($pilotid)
 	 * @param int The pilot ID for which to generate a signature for
 	 * @return bool Success
 	 */
-	public function generateSignature($pilotid)
+	public static function generateSignature($pilotid)
 	{
 		$pilot = self::getPilotData($pilotid);
 		$pilotcode = self::getPilotCode($pilot->code, $pilot->pilotid);