svn: /web/doc-editor/trunk/php/ File.php

yannick                                  Sun, 19 Jun 2011 22:11:25 +0000

Revision: http://svn.php.net/viewvc?view=revision&revision=312308

Log:
Fix security issue - reported by Neal Poole

Changed paths:
    U   web/doc-editor/trunk/php/File.php

Modified: web/doc-editor/trunk/php/File.php
===================================================================
--- web/doc-editor/trunk/php/File.php	2011-06-19 22:06:19 UTC (rev 312307)
+++ web/doc-editor/trunk/php/File.php	2011-06-19 22:11:25 UTC (rev 312308)
@@ -293,6 +293,7 @@
     public function isModified()
     {
         $am      = AccountManager::getInstance();
+        $db      = DBConnection::getInstance();
         $project = $am->project;

         // If the current file is a .new file, we must escape the .new otherwise, we haven't any result from the database
@@ -317,12 +318,12 @@
                 `path`="%s" AND
                 `name`="%s"',
             $project,
-            $this->lang,
-            $this->path,
-            $hereName
+            $db->real_escape_string($this->lang),
+            $db->real_escape_string($this->path),
+            $db->real_escape_string($hereName)
         );

-        $r = DBConnection::getInstance()->query($s);
+        $r = $db->query($s);

         if( $r->num_rows == 0 ) {
             return false;