cache_clear_all uses direct input as table name to delete from
Xano - March 24, 2008 - 20:15
| Project: | Drupal |
| Version: | 6.x-dev |
| Component: | base system |
| Category: | bug report |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | active |
Description
<?php
function cache_clear_all($cid = NULL, $table = NULL, $wildcard = FALSE) {
?>and
<?php
db_query("DELETE FROM {". $table ."}");
?>When passing on the wrong value for $table the wrong table can be wiped out accidentally. This can easily occur when making a typo (like I just did) or when there's a bug in a third-party module that allows users to enter a value for $table indirectly (hardly plausible, but possible).