external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Escape wildcards in "LIKE" patterns

Browse source 
Percent signs ("%") and underscores ("_") are not escaped by
mysql_real_escape_string() and are interpreted as wildcards if combined
with "LIKE". Write a wrapper function db_escape_like() and use it where
appropriate.

Note that we already fixed this for the RPC interface in commit
da2ebb667b but missed the other places.
This patch should fix all remaining flaws reported in FS#26527.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Signed-off-by: Dan McGee <dan@archlinux.org>
This commit is contained in:
Lukas Fleischer 2011-10-20 08:43:44 +02:00
parent 10b6a8fff7
commit e53b91fe52
4 changed files with 15 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

12
web/lib/pkgfuncs.inc.php
View file

@ -457,11 +457,9 @@ function pkg_search_page($SID="", $dbh=NULL) {
}
if (isset($_GET['K'])) {
$_GET['K'] = db_escape_string(trim($_GET['K']));
# Search by maintainer
if (isset($_GET["SeB"]) && $_GET["SeB"] == "m") {
$q_where .= "AND Users.Username = '".$_GET['K']."' ";
$q_where .= "AND Users.Username = '".db_escape_string($_GET['K'])."' ";
}
# Search by submitter
elseif (isset($_GET["SeB"]) && $_GET["SeB"] == "s") {
@ -469,16 +467,16 @@ function pkg_search_page($SID="", $dbh=NULL) {
}
# Search by name
elseif (isset($_GET["SeB"]) && $_GET["SeB"] == "n") {
$q_where .= "AND (Name LIKE '%".$_GET['K']."%') ";
$q_where .= "AND (Name LIKE '%".db_escape_like($_GET['K'])."%') ";
}
# Search by name (exact match)
elseif (isset($_GET["SeB"]) && $_GET["SeB"] == "x") {
$q_where .= "AND (Name = '".$_GET['K']."') ";
$q_where .= "AND (Name = '".db_escape_string($_GET['K'])."') ";
}
# Search by name and description (Default)
else {
$q_where .= "AND (Name LIKE '%".$_GET['K']."%' OR ";
$q_where .= "Description LIKE '%".$_GET['K']."%') ";
$q_where .= "AND (Name LIKE '%".db_escape_like($_GET['K'])."%' OR ";
$q_where .= "Description LIKE '%".db_escape_like($_GET['K'])."%') ";
}
}