external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Escape wildcards in "LIKE" patterns

Browse source 
Percent signs ("%") and underscores ("_") are not escaped by
mysql_real_escape_string() and are interpreted as wildcards if combined
with "LIKE". Write a wrapper function db_escape_like() and use it where
appropriate.

Note that we already fixed this for the RPC interface in commit
da2ebb667b but missed the other places.
This patch should fix all remaining flaws reported in FS#26527.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Signed-off-by: Dan McGee <dan@archlinux.org>
This commit is contained in:
Lukas Fleischer 2011-10-20 08:43:44 +02:00
parent 323d418f02
commit 47c5167acb
4 changed files with 15 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
web/lib/acctfuncs.inc.php
View file

@ -373,19 +373,19 @@ function search_results_page($UTYPE,$O=0,$SB="",$U="",$T="",
$search_vars[] = "S"; $search_vars[] = "S";
} }
if ($U) { if ($U) {
$q.= "AND Username LIKE '%".db_escape_string($U)."%' "; $q.= "AND Username LIKE '%".db_escape_like($U)."%' ";
$search_vars[] = "U"; $search_vars[] = "U";
} }
if ($E) { if ($E) {
$q.= "AND Email LIKE '%".db_escape_string($E)."%' "; $q.= "AND Email LIKE '%".db_escape_like($E)."%' ";
$search_vars[] = "E"; $search_vars[] = "E";
} }
if ($R) { if ($R) {
$q.= "AND RealName LIKE '%".db_escape_string($R)."%' "; $q.= "AND RealName LIKE '%".db_escape_like($R)."%' ";
$search_vars[] = "R"; $search_vars[] = "R";
} }
if ($I) { if ($I) {
$q.= "AND IRCNick LIKE '%".db_escape_string($I)."%' "; $q.= "AND IRCNick LIKE '%".db_escape_like($I)."%' ";
$search_vars[] = "I"; $search_vars[] = "I";
} }
switch ($SB) { switch ($SB) {

5
web/lib/aur.inc.php
View file

@ -229,6 +229,11 @@ function db_escape_string($string) {
return mysql_real_escape_string($string); return mysql_real_escape_string($string);
} }
# Escape strings for usage in SQL LIKE operators.
function db_escape_like($string) {
return addcslashes(mysql_real_escape_string($string), '%_');
}
# disconnect from the database # disconnect from the database
# this won't normally be needed as PHP/reference counting will take care of # this won't normally be needed as PHP/reference counting will take care of
# closing the connection once it is no longer referenced # closing the connection once it is no longer referenced

3
web/lib/aurjson.class.php
View file

@ -195,8 +195,7 @@ class AurJSON {
return $this->json_error('Query arg too small'); return $this->json_error('Query arg too small');
} }
$keyword_string = db_escape_string($keyword_string, $this->dbh); $keyword_string = db_escape_like($keyword_string, $this->dbh);
$keyword_string = addcslashes($keyword_string, '%_');
$where_condition = "( Name LIKE '%{$keyword_string}%' OR " . $where_condition = "( Name LIKE '%{$keyword_string}%' OR " .
"Description LIKE '%{$keyword_string}%' )"; "Description LIKE '%{$keyword_string}%' )";

12
web/lib/pkgfuncs.inc.php
View file

@ -457,11 +457,9 @@ function pkg_search_page($SID="", $dbh=NULL) {
} }
if (isset($_GET['K'])) { if (isset($_GET['K'])) {
$_GET['K'] = db_escape_string(trim($_GET['K']));
# Search by maintainer # Search by maintainer
if (isset($_GET["SeB"]) && $_GET["SeB"] == "m") { if (isset($_GET["SeB"]) && $_GET["SeB"] == "m") {
$q_where .= "AND Users.Username = '".$_GET['K']."' "; $q_where .= "AND Users.Username = '".db_escape_string($_GET['K'])."' ";
} }
# Search by submitter # Search by submitter
elseif (isset($_GET["SeB"]) && $_GET["SeB"] == "s") { elseif (isset($_GET["SeB"]) && $_GET["SeB"] == "s") {
@ -469,16 +467,16 @@ function pkg_search_page($SID="", $dbh=NULL) {
} }
# Search by name # Search by name
elseif (isset($_GET["SeB"]) && $_GET["SeB"] == "n") { elseif (isset($_GET["SeB"]) && $_GET["SeB"] == "n") {
$q_where .= "AND (Name LIKE '%".$_GET['K']."%') "; $q_where .= "AND (Name LIKE '%".db_escape_like($_GET['K'])."%') ";
} }
# Search by name (exact match) # Search by name (exact match)
elseif (isset($_GET["SeB"]) && $_GET["SeB"] == "x") { elseif (isset($_GET["SeB"]) && $_GET["SeB"] == "x") {
$q_where .= "AND (Name = '".$_GET['K']."') "; $q_where .= "AND (Name = '".db_escape_string($_GET['K'])."') ";
} }
# Search by name and description (Default) # Search by name and description (Default)
else { else {
$q_where .= "AND (Name LIKE '%".$_GET['K']."%' OR "; $q_where .= "AND (Name LIKE '%".db_escape_like($_GET['K'])."%' OR ";
$q_where .= "Description LIKE '%".$_GET['K']."%') "; $q_where .= "Description LIKE '%".db_escape_like($_GET['K'])."%') ";
} }
} }