Merge pull request #976 from ss23/SS2014004-3-0

FIX Prevent SQLi when no URL filters are applied
silverstripe · Mar 26, 2014 · 43d308c · 43d308c
2 parents b6194c3 + 114df8a
commit 43d308c
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/code/model/SiteTree.php b/code/model/SiteTree.php
@@ -1584,9 +1584,10 @@ public function validURLSegment() {
 			}
 		}
 
+		$segment = Convert::raw2sql($this->URLSegment);
 		$existingPage = DataObject::get_one(
 			'SiteTree', 
-			"\"URLSegment\" = '$this->URLSegment' $IDFilter $parentFilter"
+			"\"URLSegment\" = '$segment' $IDFilter $parentFilter"
 		);
 		if ($existingPage) {
 			return false;