Attachment 577433 Details for Bug 810928 – Fix for some security issues (Cross-site scripting and SQL Injections)

[patch] Fix for some security issues (Cross-site scripting and SQL Injections)

sticky-notes-fix-sqlinjections-stored-xss.patch (text/plain), 3.58 KB, created by Othman Madjoudj on 2012-04-14 00:10:43 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Othman Madjoudj

Created: 2012-04-14 00:10:43 UTC

Size: 3.58 KB

patch

obsolete

>diff --git a/admin/modules/mod_pastes.php b/admin/modules/mod_pastes.php
>index 9292d33..069aa54 100755
>--- a/admin/modules/mod_pastes.php
>+++ b/admin/modules/mod_pastes.php
>@@ -27,6 +27,8 @@ if (!$paste_search)
>     $paste_id = $paste_id_searched;
> }
> 
>+$db->escape($paste_id);
>+
> // Make public
> if ($paste_makepub)
> {  
>diff --git a/admin/modules/mod_users.php b/admin/modules/mod_users.php
>index d6763db..232eda1 100755
>--- a/admin/modules/mod_users.php
>+++ b/admin/modules/mod_users.php
>@@ -115,6 +115,7 @@ if ($user_save)
>     $db->escape($user_email);
>     $db->escape($user_fname);
>     $db->escape($user_lname);
>+    $db->escape($user_id);
>     
>     $disp_name = $user_fname . ' ' . $user_lname;
> 
>diff --git a/list.php b/list.php
>index 37313b9..ded58fb 100755
>--- a/list.php
>+++ b/list.php
>@@ -58,6 +58,9 @@ else
>     $lim_start = ($page * 10) - 10;
> }
> 
>+// Escape the project
>+$db->escape($project);
>+
> // Get total number of posts
> $sql = "SELECT COUNT(id) AS total FROM {$db->prefix}main WHERE " .
>        (!empty($project) ? "project='{$project}' AND " : '') .
>@@ -68,8 +71,6 @@ $total = $row[0]['total'];
> // Get page numbers
> $pagination = $skin->pagination($total, $page);
> 
>-// Escape the project
>-$db->escape($project);
> 
> // Get the list
> $sql = "SELECT * FROM {$db->prefix}main WHERE " .
>@@ -109,7 +110,7 @@ foreach ($rows as $row)
>     $geshi->set_overall_style('word-wrap:break-word;');
> 
>     // Generate the data
>-    $user = empty($row['author']) ? $lang->get('anonymous') : $row['author'];
>+    $user = empty($row['author']) ? $lang->get('anonymous') : htmlentities($row['author']);
>     $timestamp = $row['timestamp'];
>     $time = date('d M Y, h:i:s e', $timestamp);
>     $info = $lang->get('posted_info');
>@@ -141,7 +142,7 @@ foreach ($rows as $row)
>         'paste_id'          => $row['id'],
>         'paste_url'         => $nav->get_paste($row['id'], null, $project, $rss),
>         'paste_data'        => $code_data,
>-        'paste_lang'        => $row['language'],
>+        'paste_lang'        => htmlentities($row['language']),
>         'paste_info'        => $info,
>         'paste_time'        => $time,
>         'paste_timestamp'   => $timestamp,
>diff --git a/show.php b/show.php
>index cb7ab56..330ea97 100755
>--- a/show.php
>+++ b/show.php
>@@ -53,6 +53,8 @@ if ($paste_id == 0)
>     $core->redirect($core->path() . 'all/');
> }
> 
>+$db->escape($paste_id);
>+
> // Get the paste data
> $sql = "SELECT * FROM {$db->prefix}main WHERE id={$paste_id} LIMIT 1";
> $row = $db->query($sql, true);
>@@ -111,6 +113,8 @@ if ($row['private'] == "1")
> // Check if password cookie is there
> if (!empty($row['password']) && !empty($sid))
> {
>+    $db->escape($sid);
>+
>     // Clean up the session data every 30 seconds
>     if (time() % 30 == 0)
>     {
>@@ -208,7 +212,7 @@ $geshi->set_line_style('background: #f7f7f7; text-shadow: 0px 1px #fff; padding:
> $geshi->set_overall_style('word-wrap:break-word;');
> 
> // Generate the data
>-$user = empty($row['author']) ? $lang->get('anonymous') : $row['author'];
>+$user = empty($row['author']) ? $lang->get('anonymous') : htmlentities($row['author']);
> $time = date('d M Y, h:i:s e', $row['timestamp']);
> $info = $lang->get('posted_info');
> 
>@@ -225,7 +229,7 @@ $skin->escape($code_data);
> $skin->assign(array(
>     'paste_id'          => $row['id'],
>     'paste_data'        => $code_data,
>-    'paste_lang'        => $row['language'],
>+    'paste_lang'        => htmlentities($row['language']),
>     'paste_info'        => $info,
>     'paste_user'        => $user,
>     'paste_timestamp'   => $row['timestamp'],
>@@ -252,4 +256,4 @@ else
>     $skin->output();
> }
> 
>-?>
>\ No newline at end of file
>+?>

Actions: View | Diff

Attachments on bug 810928: 577135 | 577191 | 577433