[SECURITY] Bug 219044: A user with 'editkeywords' privileges (i.e. usually an…

[SECURITY] Bug 219044: A user with 'editkeywords' privileges (i.e. usually an administrator) can inject arbitrary SQL via the URL used to edit an existing keyword. Patch by Joel Peshkin <bugreport@peshkin.net> r= justdave, zach a= justdave

[SECURITY] Bug 219044: A user with 'editkeywords' privileges (i.e. usually an…
a4e75a43 · justdave%syndicomm.com · a30e5f2c · a4e75a43
Commit a4e75a43 authored Nov 03, 2003 by justdave%syndicomm.com
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 0 deletions

editkeywords.cgi editkeywords.cgi +1 -0

No files found.
--- a/editkeywords.cgi
+++ b/editkeywords.cgi
@@ -126,6 +126,7 @@ unless (UserInGroup("editkeywords")) {


 my $action  = trim($::FORM{action}  || '');
+detaint_natural($::FORM{id});


 if ($action eq "") {