tonyair/silverstripe-reports
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-reports synced 2024-10-01 05:39:36 +02:00
Code Issues Projects Releases Wiki Activity

Merge pull request #977 from ss23/SS2014004-3-1

Browse Source 
FIX Prevent SQLi when no URL filters are applied
This commit is contained in:
Damian Mooyman 2014-03-27 11:27:23 +13:00
commit 17b3e3e99f
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
code/model/SiteTree.php
View File

@ -1643,9 +1643,10 @@ class SiteTree extends DataObject implements PermissionProvider,i18nEntityProvid
return min($votes); return min($votes);
} }
$segment = Convert::raw2sql($this->URLSegment);
$existingPage = DataObject::get_one( $existingPage = DataObject::get_one(
'SiteTree', 'SiteTree',
"\"SiteTree\".\"URLSegment\" = '$this->URLSegment' $IDFilter $parentFilter" "\"SiteTree\".\"URLSegment\" = '$segment' $IDFilter $parentFilter"
); );
return !($existingPage); return !($existingPage);