com web/bugs: escape the project param: include/functions.php
| From: | Ferenc Kovacs | Date: | Wed, 11 Jun 2014 08:34:02 +0000 |
| Subject: | com web/bugs: escape the project param: include/functions.php | ||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-19235@lists.php.net to get a copy of this message | ||
Commit: e353f1f83f51adb95a5fc981e0ee37d2374602d5
Author: kovacs.ferenc <kovacs.ferenc@ustream.tv> Wed, 11 Jun 2014 10:34:02 +0200
Parents: 7a58a2d45ef15e041ec9a4bac7e8fbb092285fc6
Branches: master
Link: http://git.php.net/?p=web/bugs.git;a=commitdiff;h=e353f1f83f51adb95a5fc981e0ee37d2374602d5
Log:
escape the project param
Changed paths:
M include/functions.php
Diff:
diff --git a/include/functions.php b/include/functions.php
index 0782e23..b092260 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -1572,6 +1572,8 @@ function get_resolve_reasons($project = false)
$where = '';
+ $project = escapeSQL($project);
+
if ($project !== false)
$where.= "WHERE (project = '{$project}' OR project = '')";