[#20653] SQL Injection: $phrase is escaped now, yet most of the plugi…

…ns have to be updated according to plugin_content_title.php git-svn-id: http://joomlacode.org/svn/titlelink@27 de31ee7e-3f2c-0410-b67e-83f64df8b4ac
gesellix · Aug 8, 2010 · b4604e5 · b4604e5
1 parent 34518c0
commit b4604e5
Show file tree

Hide file tree

Showing 4 changed files with 18 additions and 5 deletions.
diff --git a/j_1_5_x/plugin/changelog.php b/j_1_5_x/plugin/changelog.php
@@ -4,6 +4,11 @@
 
 ?>
 
+2010-08-08:
+
+- [#20653] SQL Injection: $phrase is escaped now, yet most of the plugins have to be updated according to plugin_content_title.php
+
+
 2009-06-06:
 
 - [#16580] Exact Match as default or plugin option

diff --git a/j_1_5_x/plugin/titlelink.php b/j_1_5_x/plugin/titlelink.php
@@ -592,10 +592,12 @@ function isExternal($link)
 
   function getByPlugins($database, $plugins, $phrase, $partial_match)
   {
+    $phrase_escaped = $database->getEscaped($phrase, true);
+
     $count = count($plugins);
     for ($i = 0; $i < $count; $i++)
     {
-      $result = call_user_func($plugins[$i], $database, $phrase, $partial_match);
+      $result = call_user_func($plugins[$i], $database, $phrase_escaped, $partial_match);
 
       // magix number '2' is the amount of strings we need as result
       if (count($result) == 2)

diff --git a/j_1_5_x/plugin/titlelink.xml b/j_1_5_x/plugin/titlelink.xml
@@ -3,11 +3,11 @@
 	<name>Content - TitleLink</name>
 	<author>Tobias Gesellchen</author>
 	<creationDate>2008-06-03</creationDate>
-	<copyright>(C) 2005-2009 Tobias Gesellchen. All rights reserved.</copyright>
+	<copyright>(C) 2005-2010 Tobias Gesellchen. All rights reserved.</copyright>
 	<license>http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL</license>
 	<authorEmail>tobias@gesellix.de</authorEmail>
 	<authorUrl>www.gesellix.de</authorUrl>
-	<version>3.2.0 2009-06-06 stable</version>
+	<version>3.2.1 2010-08-08 stable</version>
   <description>DESCTITLELINK</description>
   <files>
     <filename plugin="titlelink">titlelink.php</filename>

diff --git a/j_1_5_x/plugin/titlelink_plugins/plugin_content_title.php b/j_1_5_x/plugin/titlelink_plugins/plugin_content_title.php
@@ -27,12 +27,18 @@ function plugin_contentTitle($database, $phrase, $partial_match = true)
 
   $where_clause = " WHERE a.state=1 ";
 
-  $where_variant = " AND a.alias " . (($partial_match) ? " LIKE '%$phrase%'" : "= '$phrase'");
+  $where_variant = " AND a.alias " .
+  				(($partial_match)
+  					? " LIKE ".$database->quote('%'.$phrase.'%', false)
+    				: "= ".$database->quote($phrase, false));
   $result = findContentInternal($database, $query.$where_clause.$where_variant, false);
 
   if ($result == null)
   {
-    $where_variant = " AND a.title " . (($partial_match) ? " LIKE '%$phrase%'" : "= '$phrase'");
+    $where_variant = " AND a.title " .
+  				(($partial_match)
+  					? " LIKE ".$database->quote('%'.$phrase.'%', false)
+  					: "= ".$database->quote($phrase, false));
   	$result = findContentInternal($database, $query.$where_clause.$where_variant, true);
   }