Re: [RFC] [VOTE] is_literal
| From: | Craig Francis | Date: | Fri, 16 Jul 2021 00:47:20 +0000 |
| Subject: | Re: [RFC] [VOTE] is_literal | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-115429@lists.php.net to get a copy of this message | ||
Just another day, and another injection vulnerability (please patch):
https://woocommerce.com/posts/critical-vulnerability-detected-july-2021/
If only escaping wasn't being used, so user values did not get included in
certain strings :-)
diff -r
woocommerce.5.5.0/includes/data-stores/class-wc-webhook-data-store.php
woocommerce.5.5.1/includes/data-stores/class-wc-webhook-data-store.php
280c280
< $search = ! empty( $args['search'] ) ? "AND
name LIKE
'%" .
$wpdb->esc_like( sanitize_text_field( $args['search'] ) ) . "%'" :
'';
---
> $search = ! empty( $args['search'] ) ? $wpdb->prepare( "AND
name LIKE %s", '%' . $wpdb->esc_like( sanitize_text_field(
$args['search'] ) ) . '%' ) : '';
The vote for the is_literal RFC ends on Monday the 19th of July, 7:30pm UK
time and 6:30pm UTC, and needs your support.
https://wiki.php.net/rfc/is_literal