Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issue 19500 sql injection containers #19501

Merged
merged 10 commits into from
Oct 28, 2020

Conversation

wezell
Copy link
Contributor

@wezell wezell commented Oct 27, 2020

Adds the sanitizeOrderBy to the incoming variable.

@wezell wezell changed the base branch from master to release-20.10.1 October 27, 2020 13:04
@wezell
Copy link
Contributor Author

wezell commented Oct 27, 2020

These codepaths were checked:

  • CategoriesPaginator
  • ContainerPaginator
  • ContentTypesPaginator
  • PersonalizationPersonaPageViewPaginator
  • SitePaginator
  • SiteViewPaginator
  • TemplatePaginator
  • UserPaginatoy

@dsilvam dsilvam merged commit ec4fc4d into release-20.10.1 Oct 28, 2020
@delete-merged-branch delete-merged-branch bot deleted the issue-19500-sql-injection-containers branch October 28, 2020 00:55
dsilvam added a commit that referenced this pull request Nov 4, 2020
* Update dotcmsReleaseVersion and coreWebReleasion version

* update release version

* #18505 JSONTool does not return sub arrays

* #18505 now the JSONTool uses the Jackson to map the string json as a single Maps and Lists

* #18505 now the JSONTool uses the Jackson to map the string json as a single Maps and Lists

* #19364 Unable to edit category permissions as limited user even you have full rights

* #18314 Make Query Tool Use fetch() to fill response

* #19098 SAML update logout page.  (#19450)

* include css in jsp

* label updated

* Updating sql files (#19478)

* Updating sql files to remove contraints

* Updating sql files to remove contraints

* #18690 Allow Push publish just for enterprise license in the receiver (#19492)

* #18690 Allow Push publish just for enterprise license in the receiver

* testing

* Fixing test

* Issue 19500 sql injection containers (#19501)

* #18605 pauses and then unpauses based on a cache invalidation

* #18605 adding ttl to the cache put in the logger

* #18605 less logging

* #19500 sanitize sql

* #19500 fixes potential sql vunerabilities

* #19500 writing tests

* #19500 tests

* we should not need TLS set to true

* #19500 removing unneeded files

* #19338 dont lowercase (#19506)

* #19338 dont lowercase

* #19338 integration test

* #19338 missing test resource

* #19509 use proper db columm in query (#19510)

* #19509 use proper db columm in query

* #19509 use proper property from contentlet

* #19509 fix integration test

* #19509 fix integration test

* #19471 Use proper value when discarding conflicts (#19519)

* #18780 fixes job when new hostname starts with  original hostname (#19522)

* #19509 Fixing bug when use comma in host's name (#19528)

* #19509 Fixing bug when use comma in host's name

* Fixing test

* update core-web version

* merge with master

* Update .gitmodules

* Update gradle.properties

Co-authored-by: Jonathan <jonathan.sanchez@dotcms.com>
Co-authored-by: erickgonzalez <erick.gonzalez@dotcms.com>
Co-authored-by: hmoreras <31667212+hmoreras@users.noreply.github.com>
Co-authored-by: Freddy Rodriguez <freddy0309@gmail.com>
Co-authored-by: Will Ezell <will@dotcms.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants