[TikiWiki-commits] [Git][tikiwiki/tiki][24.x] [FIX] Wiki rankings: prevent SQL injection via categId

Espoir Baraka pushed to branch 24.x at Tiki Wiki CMS Groupware / Tiki


Commits:
4827ef28 by Espoir Baraka at 2026-08-18T11:09:00+02:00
[FIX] Wiki rankings: prevent SQL injection via categId
---
* [FIX] Wiki rankings: prevent SQL injection via categId
---
* [FIX] Wiki rankings: prevent SQL injection via categId
---
* [FIX] Wiki rankings: prevent SQL injection via categId
---
* [FIX] Wiki rankings: prevent SQL injection via categId
---
* [FIX] Wiki rankings: prevent SQL injection via categId

- Improved category ID processing in `tiki-wiki_rankings.php` to ensure only positive integers are assigned.
- Introduced a new private method `buildWikiCategoryJoin` in `ranklib.php` to streamline SQL query construction for category joins, enhancing code readability and maintainability.

These changes enhance the robustness of category filtering in the rankings functionality.

(cherry picked from commit 7e4984fb4f0b047ccd5ad9816b3da9436abecbdc)

See merge request tikiwiki/tiki!10908

(cherry picked from commit 77114f7819f4a8b170c348f89f346b672f8002cf)

See merge request tikiwiki/tiki!10913

(cherry picked from commit d843dad0a5325503115803cafe87b7bdfaa1e2f8)

See merge request tikiwiki/tiki!10928

(cherry picked from commit ea828b24cce71b42d5780492f2ee2fb9a6b5a553)

See merge request tikiwiki/tiki!10932

(cherry picked from commit 26c30990543f1139865dd5ee438fee3227c32f17)

See merge request tikiwiki/tiki!10938

- - - - -


2 changed files:

- lib/rankings/ranklib.php
- tiki-wiki_rankings.php


Changes:

=====================================
lib/rankings/ranklib.php
=====================================
@@ -17,6 +17,34 @@ if (strpos($_SERVER["SCRIPT_NAME"], basename(__FILE__)) !== false) {
  */
 class RankLib extends TikiLib
 {
+    /**
+     * Build a parameterized wiki-page category join filter.
+     *
+     * @param array $categ Category ids (non-integers and non-positive values are ignored)
+     * @return array{0: string, 1: array} SQL fragment and bind values
+     */
+    private function buildWikiCategoryJoin(array $categ): array
+    {
+        $categIds = [];
+        foreach ($categ as $categId) {
+            $categId = (int) $categId;
+            if ($categId > 0) {
+                $categIds[] = $categId;
+            }
+        }
+
+        if (! $categIds) {
+            return ['', []];
+        }
+
+        $placeholders = implode(',', array_fill(0, count($categIds), '?'));
+        $mid = " INNER JOIN (`tiki_objects` as tob, `tiki_category_objects` as tco)"
+            . " ON (tp.`pageName` = tob.`itemId` and tob.`objectId` = tco.`catObjectId`)"
+            . " WHERE tob.`type` = 'wiki page' AND tco.`categId` IN ($placeholders)";
+
+        return [$mid, $categIds];
+    }
+
     /**
      * @param $limit
      * @param array $categ
@@ -28,17 +56,7 @@ class RankLib extends TikiLib
         global $user, $prefs;
         $pagesAdded = [];
 
-        $bindvals = [];
-        $mid = '';
-        if ($categ) {
-            $mid .= " INNER JOIN (`tiki_objects` as tob, `tiki_category_objects` as tco) ON (tp.`pageName` = tob.`itemId` and tob.`objectId` = tco.`catObjectId`) WHERE tob.`type` = 'wiki page' AND (tco.`categId` = ?";
-            $bindvals[] = $categ[0];
-            //FIXME
-            for ($i = 1, $icount_categ = count($categ); $i < $icount_categ; $i++) {
-                $mid .= " OR tco.`categId` = " . $categ[$i];
-            }
-            $mid .= ")";
-        }
+        [$mid, $bindvals] = $this->buildWikiCategoryJoin($categ);
 
         $query = "select distinct tp.`pageName`, tp.`hits`, tp.`lang`, tp.`page_id` from `tiki_pages` tp $mid order by `hits` desc";
 
@@ -95,17 +113,7 @@ class RankLib extends TikiLib
             $this->pageRank();
         }
 
-        $bindvals = [];
-        $mid = '';
-        if ($categ) {
-            $mid .= " INNER JOIN (`tiki_objects` as tob, `tiki_category_objects` as tco) ON (tp.`pageName` = tob.`itemId` and tob.`objectId` = tco.`catObjectId`) WHERE tob.`type` = 'wiki page' AND (tco.`categId` = ?";
-        //FIXME
-            $bindvals[] = $categ[0];
-            for ($i = 1, $icount_categ = count($categ); $i < $icount_categ; $i++) {
-                $mid .= " OR tco.`categId` = " . $categ[$i];
-            }
-            $mid .= ")";
-        }
+        [$mid, $bindvals] = $this->buildWikiCategoryJoin($categ);
 
         $query = "select tp.`pageName`, tp.`pageRank` from `tiki_pages` tp $mid order by `pageRank` desc";
 
@@ -138,17 +146,7 @@ class RankLib extends TikiLib
     {
         global $user, $prefs;
 
-        $bindvals = [];
-        $mid = '';
-        if ($categ) {
-            $mid .= " INNER JOIN (`tiki_objects` as tob, `tiki_category_objects` as tco) ON (tp.`pageName` = tob.`itemId` and tob.`objectId` = tco.`catObjectId`) WHERE tob.`type` = 'wiki page' AND (tco.`categId` = ?";
-            //FIXME
-            $bindvals[] = $categ[0];
-            for ($i = 1, $icount_categ = count($categ); $i < $icount_categ; $i++) {
-                $mid .= " OR tco.`categId` = " . $categ[$i];
-            }
-            $mid .= ")";
-        }
+        [$mid, $bindvals] = $this->buildWikiCategoryJoin($categ);
 
         $query = "select tp.`pageName`, tp.`lastModif`, tp.`hits` from `tiki_pages` tp $mid order by `lastModif` desc";
 
@@ -602,23 +600,7 @@ $query = "select a.*, tf.*, max(b.`commentDate`) as `lastPost` from
      */
     public function wiki_ranking_top_authors($limit, $categ = [])
     {
-        global $user;
-
-        $bindvals = [];
-        $mid = '';
-        if ($categ) {
-            $mid .= " INNER JOIN (`tiki_objects` as tob, `tiki_category_objects` as tco) ON (tp.`pageName` = tob.`itemId` and tob.`objectId` = tco.`catObjectId`)
-                WHERE tob.`type` = 'wiki page'
-                AND (tco.`categId` = ?"
-            ;
-
-            //FIXME
-            $bindvals[] = $categ[0];
-            for ($i = 1, $icount_categ = count($categ); $i < $icount_categ; $i++) {
-                $mid .= " OR tco.`categId` = " . $categ[$i];
-            }
-            $mid .= ")";
-        }
+        [$mid, $bindvals] = $this->buildWikiCategoryJoin($categ);
         $query = "select distinct tp.`user`, count(*) as `numb` from `tiki_pages` tp $mid group by `user` order by " . $this->convertSortMode("numb_desc");
 
         $result = $this->query($query, $bindvals, $limit, 0);


=====================================
tiki-wiki_rankings.php
=====================================
@@ -25,12 +25,16 @@ if (! isset($_REQUEST["limit"])) {
     $limit = $_REQUEST["limit"];
 }
 
-if (isset($_REQUEST["categId"]) && $_REQUEST["categId"] > 0) {
-    $smarty->assign('categIdstr', $_REQUEST["categId"]);
-    $categs = explode(",", $_REQUEST["categId"]);
-} else {
-    $categs = [];
+$categs = [];
+if (isset($_REQUEST["categId"])) {
+    foreach (explode(",", (string) $_REQUEST["categId"]) as $categId) {
+        $categId = (int) $categId;
+        if ($categId > 0) {
+            $categs[] = $categId;
+        }
+    }
 }
+$smarty->assign('categIdstr', implode(',', $categs));
 $smarty->assign('categId', $categs);
 
 $allrankings = [



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/4827ef285bbbf1b4acf2a90fcacce66665385d70

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/4827ef285bbbf1b4acf2a90fcacce66665385d70
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs