L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-19709 fixed missing quoting in upgrade code, safer tag api

Browse Source
This commit is contained in:
skodak
2009-09-26 19:47:07 +00:00
parent 601cd4ebd7
commit 3cc5c930cb
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
blog/index.php
+1 -1
View File
@@ -165,7 +165,7 @@ if (empty($courseid)) {
include($CFG->dirroot .'/blog/header.php');
blog_print_html_formatted_entries($postid, $filtertype, $filterselect, $tagid, $tag);
blog_print_html_formatted_entries($postid, $filtertype, $filterselect, $tagid, stripslashes($tag));
add_to_log($courseid, 'blog', 'view', 'index.php?filtertype='.$filtertype.'&filterselect='.$filterselect.'&postid='.$postid.'&tagid='.$tagid.'&tag='.$tag, 'view blog entry');
blog/lib.php
+1 -1
View File
@@ -495,7 +495,7 @@
if ($tagid) {
$tag = $tagid;
} else if ($tag) {
if ($tagrec = get_record_sql('SELECT * FROM '.$CFG->prefix.'tag WHERE name LIKE "'.$tag.'"')) {
if ($tagrec = get_record_sql('SELECT * FROM '.$CFG->prefix.'tag WHERE name LIKE "'.addslashes($tag).'"')) {
$tag = $tagrec->id;
} else {
$tag = -1; //no records found
lib/db/upgrade.php
+2 -2
View File
@@ -1780,7 +1780,7 @@ function xmldb_main_upgrade($oldversion=0) {
$raw_normalized = clean_param($oldtag->text, PARAM_TAG);
$normalized = moodle_strtolower($raw_normalized);
// if this tag does not exist in tag table yet
if (!$newtag = get_record('tag', 'name', $normalized, '', '', '', '', 'id')) {
if (!$newtag = get_record('tag', 'name', addslashes($normalized), '', '', '', '', 'id')) {
$itag = new object();
$itag->name = $normalized;
$itag->rawname = $raw_normalized;
@@ -1793,7 +1793,7 @@ function xmldb_main_upgrade($oldversion=0) {
$itag->tagtype = 'default';
}
if ($idx = insert_record('tag', $itag)) {
if ($idx = insert_record('tag', addslashes_recursive($itag))) {
$tagrefs[$oldtag->id] = $idx;
}
// if this tag is already used by tag table