com web/master: escape the variables coming from $_REQUEST magic_quote_gpc makes this not exploitable, but we should move away from that sooner or l
ater: manage/notes-alert.php

Commit: e7dca7e9d57a29cf93c2a5673c0d8acd275e4c1e Author: kovacs.ferenc <kovacs.ferenc@ustream.tv> Wed, 11 Jun 2014 13:48:02 +0200 Parents: bdf97a6fd4cc435707bb5c6797842ca817e41f9a Branches: master Link: http://git.php.net/?p=web/master.git;a=commitdiff;h=e7dca7e9d57a29cf93c2a5673c0d8acd275e4c1e Log: escape the variables coming from $_REQUEST magic_quote_gpc makes this not exploitable, but we should move away from that sooner or later Changed paths: M manage/notes-alert.php Diff: diff --git a/manage/notes-alert.php b/manage/notes-alert.php index d672a51..e73ed2d 100644 --- a/manage/notes-alert.php +++ b/manage/notes-alert.php @@ -7,7 +7,7 @@ head(); switch ($alert_action) { case "add_alert" : - $sql = "INSERT INTO alerts VALUES ('$cuser', '$sect', NOW())"; + $sql = "INSERT INTO alerts VALUES ('".real_clean($cuser)."', '".real_clean($sect)."', NOW())"; if (has_alert($user, $sect)) echo "<b>You already have an alert for this page</b><br />\n"; else @@ -17,7 +17,7 @@ switch ($alert_action) { echo "Unknown error while adding alert<br />\n"; break; case "del_alert" : - $sql = "delete from alerts where user='$cuser' and sect='$sect'"; + $sql = "delete from alerts where user='".real_clean($cuser)."' and sect='"..real_clean($sect)."'"; if (has_alert($user, $sect)) if(do_alert_action($sql)) echo "<b>Alert for page \"$sect\", deleted from your list</b></ br>";