tonyair/silverstripe-cms
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-cms synced 2024-10-22 08:05:56 +02:00
Code Issues Projects Releases Wiki Activity

FIX Prevent SQLi when no URL filters are applied

Browse Source
This commit is contained in:
Stephen Shkardoon 2014-03-19 19:05:13 +13:00
parent 7002dcfa7f
commit 8e50405871
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
code/model/SiteTree.php
View File

@ -1643,9 +1643,10 @@ class SiteTree extends DataObject implements PermissionProvider,i18nEntityProvid
return min($votes); return min($votes);
} }
$segment = Convert::raw2sql($this->URLSegment);
$existingPage = DataObject::get_one( $existingPage = DataObject::get_one(
'SiteTree', 'SiteTree',
"\"SiteTree\".\"URLSegment\" = '$this->URLSegment' $IDFilter $parentFilter" "\"SiteTree\".\"URLSegment\" = '$segment' $IDFilter $parentFilter"
); );
return !($existingPage); return !($existingPage);