svn: /web/doc-editor/trunk/php/ RepositoryFetcher.php UserNotes.php

yannick                                  Sun, 19 Jun 2011 22:06:19 +0000

Revision: http://svn.php.net/viewvc?view=revision&revision=312307

Log:
Fix security issue

Changed paths:
    U   web/doc-editor/trunk/php/RepositoryFetcher.php
    U   web/doc-editor/trunk/php/UserNotes.php

Modified: web/doc-editor/trunk/php/RepositoryFetcher.php
===================================================================
--- web/doc-editor/trunk/php/RepositoryFetcher.php	2011-06-19 21:56:09 UTC (rev 312306)
+++ web/doc-editor/trunk/php/RepositoryFetcher.php	2011-06-19 22:06:19 UTC (rev 312307)
@@ -92,7 +92,7 @@
              ORDER BY `date` DESC
              LIMIT %s, %s',

-            $am->project, $start, $limit
+            $am->project, (int)$start, (int)$limit
         );
         $r = DBConnection::getInstance()->query($s);

@@ -1100,15 +1100,19 @@
     public function getFileByKeyword($key)
     {
         $am      = AccountManager::getInstance();
+        $db      = DBConnection::getInstance();
         $vcsLang = $am->vcsLang;
         $project = $am->project;

         $s = sprintf(
             'SELECT `lang`, `path`, `name` FROM `files` WHERE `project`="%s" AND  (`lang`="%s" OR `lang`=\'en\')
              AND ( `name` LIKE \'%%%s%%\' OR `xmlid` LIKE \'%%%s%%\' ) ORDER BY `lang`, `path`, `name`',
-            $project, $vcsLang, $key, $key
+            $project,
+            $vcsLang,
+            $db->real_escape_string($key),
+            $db->real_escape_string($key)
         );
-        $r = DBConnection::getInstance()->query($s);
+        $r = $db->query($s);

         $files = array();
         while ($a = $r->fetch_object()) {

Modified: web/doc-editor/trunk/php/UserNotes.php
===================================================================
--- web/doc-editor/trunk/php/UserNotes.php	2011-06-19 21:56:09 UTC (rev 312306)
+++ web/doc-editor/trunk/php/UserNotes.php	2011-06-19 22:06:19 UTC (rev 312307)
@@ -24,8 +24,8 @@

     public function getNotes($file)
     {
-
         $am = AccountManager::getInstance();
+        $db = DBConnection::getInstance();
         $project = $am->project;

         $s = sprintf(
@@ -36,10 +36,10 @@
              WHERE
                 `project` = "%s" AND `file`="%s"',
             $project,
-            $file // must be like this : fr/reference/cairo/cairocontext/appendpath.xml
+            $db->real_escape_string($file) // must be like this : fr/reference/cairo/cairocontext/appendpath.xml
         );

-        $r = DBConnection::getInstance()->query($s);
+        $r = $db->query($s);

         $infos = array();
         while ($a = $r->fetch_assoc()) {