Bugzilla – Attachment 6582 Details for
Bug 7013
required format is not enforced for authorized values
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 7013 : Fixing sql injection problems
Bug-7013--Fixing-sql-injection-problems.patch (text/plain), 2.15 KB, created by
Chris Cormack
on 2011-12-05 15:49:00 UTC
(
hide
)
Description:
Bug 7013 : Fixing sql injection problems
Filename:
MIME Type:
Creator:
Chris Cormack
Created:
2011-12-05 15:49:00 UTC
Size:
2.15 KB
patch
obsolete
>From e4337aaba05c09bd2b1a99d594937778a736cd9b Mon Sep 17 00:00:00 2001 >From: Chris Cormack <chrisc@catalyst.net.nz> >Date: Tue, 6 Dec 2011 04:48:16 +1300 >Subject: [PATCH] Bug 7013 : Fixing sql injection problems > >--- > admin/authorised_values.pl | 12 ++++++------ > 1 files changed, 6 insertions(+), 6 deletions(-) > >diff --git a/admin/authorised_values.pl b/admin/authorised_values.pl >index b713f08..d4fed0e 100755 >--- a/admin/authorised_values.pl >+++ b/admin/authorised_values.pl >@@ -106,13 +106,13 @@ if ($op eq 'add_form') { > > if ( $new_authorised_value =~ /^[a-zA-Z0-9\-_]+$/ ) { > if ( $id ) { # Update >- my $sth = $dbh->prepare( "SELECT category, authorised_value FROM authorised_values WHERE id='$id' "); >- $sth->execute(); >+ my $sth = $dbh->prepare( "SELECT category, authorised_value FROM authorised_values WHERE id=? "); >+ $sth->execute($id); > my ($category, $authorised_value) = $sth->fetchrow_array(); > if ( $authorised_value ne $new_authorised_value ) { > my $sth = $dbh->prepare_cached( "SELECT COUNT(*) FROM authorised_values " . >- "WHERE category = '$new_category' AND authorised_value = '$new_authorised_value' and id<>$id"); >- $sth->execute(); >+ "WHERE category = ? AND authorised_value = ? and id <> ?"); >+ $sth->execute($new_category,$new_authorised_value,$id); > ($duplicate_entry) = $sth->fetchrow_array(); > warn "**** duplicate_entry = $duplicate_entry"; > } >@@ -135,8 +135,8 @@ if ($op eq 'add_form') { > } > else { # Insert > my $sth = $dbh->prepare_cached( "SELECT COUNT(*) FROM authorised_values " . >- "WHERE category = '$new_category' AND authorised_value = '$new_authorised_value' "); >- $sth->execute(); >+ "WHERE category = ? AND authorised_value = ? "); >+ $sth->execute($new_category,$new_authorised_value); > ($duplicate_entry) = $sth->fetchrow_array(); > unless ( $duplicate_entry ) { > my $sth=$dbh->prepare( 'INSERT INTO authorised_values >-- >1.7.5.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 7013
:
6577
|
6579
|
6582
|
6921