r4544 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r4543‎ | r4544 | r4545 >
Date:19:17, 6 August 2004
Author:vibber
Status:old
Tags:
Comment:
Protect against SQL insertion attacks in page move category update.
Modified paths:
  • /trunk/phase3/includes/Title.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/Title.php
@@ -902,7 +902,9 @@
903903 # Fixing category links (those without piped 'alternate' names) to be sorted under the new title
904904
905905 $dbw =& wfGetDB( DB_MASTER );
906 - $sql = "UPDATE categorylinks SET cl_sortkey=\"" . $nt->getPrefixedText() . "\" WHERE cl_from=\"" .$this->getArticleID() . "\" AND cl_sortkey=\"" . $this->getPrefixedText() . "\"" ;
 906+ $sql = "UPDATE categorylinks SET cl_sortkey=" . $dbw->addQuotes( $nt->getPrefixedText() ) .
 907+ " WHERE cl_from=" . $dbw->addQuotes( $this->getArticleID() ) .
 908+ " AND cl_sortkey=" . $dbw->addQuotes( $this->getPrefixedText() );
907909 $dbw->query( $sql, "SpecialMovepage::doSubmit" );
908910
909911

Status & tagging log