Re: [DOC-WEB] cvs: docweb /include lib_revcheck.inc.php

Isn't get_outdated_files() going to be affected as well, since it's 
pretty much the same?

     AND
         a.dir = "' . $dir . '"


M

Nuno Lopes wrote:
> nlopess		Sun Feb  5 20:44:50 2006 UTC
> 
>   Modified files:              
>     /docweb/include	lib_revcheck.inc.php 
>   Log:
>   fix sql injection bug introduced in last commit
>   
> http://cvs.php.net/viewcvs.cgi/docweb/include/lib_revcheck.inc.php?r1=1.11&r2=1.12&diff_format=u
> Index: docweb/include/lib_revcheck.inc.php
> diff -u docweb/include/lib_revcheck.inc.php:1.11 docweb/include/lib_revcheck.inc.php:1.12
> --- docweb/include/lib_revcheck.inc.php:1.11	Sun Feb  5 11:17:37 2006
> +++ docweb/include/lib_revcheck.inc.php	Sun Feb  5 20:44:50 2006
> @@ -157,7 +157,7 @@
>      AND
>          c.lang="en"
>      AND
> -        a.maintainer = "' . $user . '"
> +        a.maintainer = \'' . sqlite_escape_string($user) . '\'
>      AND
>          a.revision != c.revision order by b.name';
>      $result = sqlite_query($idx, $sql);
>