bugphpGroupWare - Bugs: bug #4411, quotes are not escaped in the...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #4411: quotes are not escaped in the location field of a cal entry

Submitted by:  Marcus Frischherz <frim>
Submitted on:  Tue 22 Jul 2003 10:53:31 AM UTC  
 
Item Group: 0.9.14.004/5/6 releaseCategory: calendar
Severity: 3 - NormalPriority: 5 - Normal
Status: FixedPrivacy: Public
Assigned to: Invalid User ID <Invalid User ID>Open/Closed: Closed
Component Version: NoneOperating System: GNU/Linux - SuSE
Reproducibility: Every TimePlanned Release: None
Fixed Release: 

Tue 22 Jul 2003 10:53:31 AM UTC, original submission:

Accidentally I made an entry into calender today, and put a name, which contains a single quote, into the location field. This resulted in an error message:

Database error: Invalid SQL: UPDATE phpgw_cal SET owner=3, datetime=1060853400, mdatetime=1058870453, edatetime=1060853400, priority=2, category='9', cal_type='E', is_public=1, title='Test', description='', location='as'df', reference=0 WHERE cal_id=82
MySQL Error: 1064 (Fehler in der Syntax bei 'df', reference=0 WHERE cal_id=82' in Zeile 1.)

File: /home/www/cal/calendar/inc/class.socalendar_sql.inc.php
Line: 498

now.. of course this is only a minor limitation, but I think forgetting the addslashes/stripslashes in html-form text fields going into SQL statements poses a security threat, doesn't it? And of course I am surprised that addslash/stripslash isn't done transperently in some class, but needs to be done explicitly (because I can have single quotes in the title of a calendar entry) so one might ask oneself, whether this particular field is the only one.

Marcus Frischherz <frim>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

No Changes Have Been Made to This Item

Back to the top


Powered by Savane 3.1-cleanup1