Fix for posted vulnerablity

In late February 2017 a hacker database site posted a vulnerability of ABPro.

This will address that vulnerability.

Edit file: \administrator\components\com_rsappt_pro3\sendmail_pro2.php

Around line 1116 (ABPro 4.x) or 1086 (ABPro 3.0.6) look for:
$sql = 'SELECT count(*) FROM #__sv_apptpro3_requests WHERE id_requests = '. $request_id.' AND cancellation_id ="'. $cc.'"';

Change to:
$sql = 'SELECT count(*) FROM #__sv_apptpro3_requests WHERE id_requests = '.$database->escape($request_id).' AND cancellation_id ="'.$database->escape($cc).'"';

Edit file: \components\com_rsappt_pro3\rsappt_pro3.php

At line 63 inset red code

//set the controller page
if (!file_exists(JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php' )){
echo "Invalid ABPro controller specified";
exit;
}
require_once (JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php');

Note: This fix is to stop a hacker from taking advantage of the published vulnerability and has only had basic testing to verify it has no detrimental effect to the operation of ABPro. If you encounter operation issues after implementing this, please email me with details.