You are here: Foswiki>Tasks Web>Item12258 (06 Nov 2018, MichaelDaum)Edit Attach

Item12258: PageCache code should not build SQL statements with string concatenation

Priority: Urgent
Current State: Closed
Released In: n/a
Target Release: minor

Applies To: Engine
Component: PageCache
Branches: trunk

Reported By: PaulHarvey
Waiting For:
Last Change By: MichaelDaum

This can cause security and instability issues.

Realized the code works this way when using JQGridPlugin with the new PageCache enabled:

ERROR: DBD::Pg::db do failed: ERROR:  syntax error at or near "TaxonProfile"
LINE 1: ...fied::connector=search::page=1::query=form.name=\'TaxonProfi...
                                                             ^ at /usr/local/src/wiki.trin.org.au/core/lib/Foswiki/PageCache/DBI.pm line 271.

-- PaulHarvey - 20 Nov 2012

ItemTemplate edit

Summary	PageCache code should not build SQL statements with string concatenation
ReportedBy	PaulHarvey
Codebase	trunk
SVN Range
AppliesTo	Engine
Component	PageCache
Priority	Urgent
CurrentState	Closed
WaitingFor
Checkins	distro:11e19d23bbe5
TargetRelease	minor
ReleasedIn	n/a
CheckinsOnBranches	trunk
trunkCheckins	distro:11e19d23bbe5
Release01x01Checkins