qbi/additional_plugins
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

3.69: Fix possible SQL injection for tagnames, thanks to Brian carpenter (geeknik) and Hanno B?ck

Browse source
This commit is contained in:
Garvin Hicking 2018-07-17 12:20:13 +02:00
parent 12aaee2e8f
commit 3edecdb7ec
2 changed files with 7 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
serendipity_event_freetag/ChangeLog
View file

@ -1,3 +1,5 @@
3.69: Fix possible SQL injection for tagnames, Thanks to Brian carpenter (geeknik) and Hanno BÃck
3.67: Iconfont a11y fix (yellowled)
3.66: Fix an issue refering to Smarty2->Smarty3 changes.

10
serendipity_event_freetag/serendipity_event_freetag.php
View file

@ -72,7 +72,7 @@ class serendipity_event_freetag extends serendipity_event
'smarty' => '2.6.7',
'php' => '4.1.0'
));
$propbag->add('version', '3.68');
$propbag->add('version', '3.69');
$propbag->add('event_hooks', array(
'frontend_fetchentries' => true,
'frontend_fetchentry' => true,
@ -1556,8 +1556,8 @@ addLoadEvent(enableAutocomplete);
} else {
if (is_string($tag)) {
$cond = "main.tag = '$tag'";
$ncond = "neg.tag != '$tag'";
$cond = "main.tag = '" . serendipity_db_escape_string($tag) . "'";
$ncond = "neg.tag != '" . serendipity_db_escape_string($tag) . "'";
$join = "LEFT JOIN {$serendipity['dbPrefix']}entrytags AS neg ".
"ON main.entryid = neg.entryid ";
$totalModifier = '';
@ -1582,8 +1582,8 @@ addLoadEvent(enableAutocomplete);
$join .= "LEFT JOIN {$serendipity['dbPrefix']}entrytags AS sub{$i} ".
"ON main.entryid = sub{$i}.entryid ";
$cond .= "sub{$i}.tag = '{$tag[$i]}' ";
$ncond .= "neg.tag != '{$tag[$i]}' ";
$cond .= "sub{$i}.tag = '" . serendipity_db_escape_string($tag[$i]) . "' ";
$ncond .= "neg.tag != '" . serendipity_db_escape_string($tag[$i]) . "' ";
}
} else {
return;