Re: cvs: docweb /include lib_revcheck.inc.php

Ye. I've fixed that one, too. Thanks, Nuno ----- Original Message -----

Isn't get_outdated_files() going to be affected as well, since it's pretty much the same?

    AND
        a.dir = "' . $dir . '"

M Nuno Lopes wrote:

nlopess Sun Feb 5 20:44:50 2006 UTC

  Modified files:              /docweb/include lib_revcheck.inc.php Log:

fix sql injection bug introduced in last commit http://cvs.php.net/viewcvs.cgi/docweb/include/lib_revcheck.inc.php?r1=1.11&r2=1.12&diff_format=u Index: docweb/include/lib_revcheck.inc.php diff -u docweb/include/lib_revcheck.inc.php:1.11 docweb/include/lib_revcheck.inc.php:1.12 --- docweb/include/lib_revcheck.inc.php:1.11 Sun Feb 5 11:17:37 2006 +++ docweb/include/lib_revcheck.inc.php Sun Feb 5 20:44:50 2006 @@ -157,7 +157,7 @@

     AND
         c.lang="en"
     AND
-        a.maintainer = "' . $user . '"
+        a.maintainer = \'' . sqlite_escape_string($user) . '\'
     AND
         a.revision != c.revision order by b.name';
     $result = sqlite_query($idx, $sql);