pift_server_retest_check() and pift_server_send_file_data() both contain queries that are using an old, potentially insecure style of passing arguments to db_query.

these need to be fixed by using proper placeholders.

CommentFileSizeAuthor
#2 pift_query_rewrite.patch7.33 KBhunmonk
#1 pift_query_rewrite.patch7.23 KBhunmonk

Comments

hunmonk’s picture

hunmonk commented
Status: Active » Needs review
StatusFileSize
new pift_query_rewrite.patch7.23 KB

attached places all query argument in proper placeholders for the offending queries.

note, still needs some cursory testing to make sure i didn't foul anything up.

hunmonk’s picture

hunmonk commented
Status: Needs review » Fixed
StatusFileSize
new pift_query_rewrite.patch7.33 KB

committed attached to HEAD. basically the same patch as above, i just needed to massage the array merging code a bit.

code is tested and working.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.