BUGFIX Fixed SQL injection in Folder::findOrMake() parameter. Exploit…

…able through Upload::, although unlikely to be set via user input.
silverstripe · Mar 21, 2011 · fef7c32 · fef7c32
1 parent 551bc5d
commit fef7c32
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/filesystem/Folder.php b/filesystem/Folder.php
@@ -42,7 +42,14 @@ static function findOrMake($folderPath) {
 		$item = null;
 		foreach($parts as $part) {
 			if(!$part) continue; // happens for paths with a trailing slash
-			$item = DataObject::get_one("Folder", "\"Name\" = '$part' AND \"ParentID\" = $parentID");
+			$item = DataObject::get_one(
+				"Folder", 
+				sprintf(
+					"\"Name\" = '%s' AND \"ParentID\" = %d",
+					Convert::raw2sql($part), 
+					(int)$parentID
+				)
+			);
 			if(!$item) {
 				$item = new Folder();
 				$item->ParentID = $parentID;