See: http://drupal.org/node/167284

%s should never be used without quotes around it. There are some bad uses in project*, but Chad and I looked at the code and none look like actual vulnerabilities.

in project:

release/project-release-create-history.php:96: 

$query = db_query("SELECT DISTINCT(prn.pid), tn.tid FROM {project_release_nodes} prn INNER JOIN {term_node} tn ON prn.nid = tn.nid WHERE tn.tid IN (%s)", implode(',', array_keys($api_terms)));
CommentFileSizeAuthor
#4 project_168649.patch1.34 KBdrewish
#3 168649_project_release_bad_s.patch_2.txt1.36 KBdww
#2 168649_project_release_bad_s.patch.txt1.34 KBdww

Comments

hunmonk’s picture

hunmonk commented
Priority: Normal » Critical

since this is a future defensive programming change, i'm not going to hold up our pending release for it. up'ing the priority to make sure it gets taken care of soon, though.

dww’s picture

dww
we/he/they
commented
Assigned: Unassigned » dww
Status: Active » Needs review
StatusFileSize
new 168649_project_release_bad_s.patch.txt1.34 KB
dww’s picture

dww
we/he/they
commented
StatusFileSize
new 168649_project_release_bad_s.patch_2.txt1.36 KB

or, better yet...

drewish’s picture

drewish commented
StatusFileSize
new project_168649.patch1.34 KB

I don't really have CVS setup right to test this but after fixing the following:

Parse error: syntax error, unexpected ')' in project-release-create-history.php on line 108

it looks good to me.

dww’s picture

dww
we/he/they
commented

tee hee, thanks. ;) that second patch was thrown together quickly and was untested...

hunmonk’s picture

hunmonk commented
Status: Needs review » Reviewed & tested by the community

looks good to me.

dww’s picture

dww
we/he/they
commented
Status: Reviewed & tested by the community » Fixed

Committed to HEAD, thanks all.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)