redports-trac:

- Fix a possible SQL injection
nivit · Jan 14, 2014 · fc2c1ea · fc2c1ea
1 parent 2b28838
commit fc2c1ea
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/redports-trac/redports/model.py b/redports-trac/redports/model.py
@@ -757,7 +757,7 @@ def __init__(self, env):
     def filter(self, owner=None, queueid=None, revision=None, uniqueports=False):
         self.owner = owner
         self.queueid = queueid
-	self.revision = int(revision)
+	self.revision = revision
         self.uniqueports = uniqueports
 
     def count(self):
@@ -772,13 +772,13 @@ def _get_filter(self):
         filter = ''
 
         if self.queueid:
-            filter += "AND buildqueue.id = '%s'" % (self.queueid)
+            filter += "AND buildqueue.id = '%s'" % (re.sub("[\"']", "", self.queueid))
 
         if self.owner:
-            filter += "AND buildqueue.owner = '%s'" % (self.owner)
+            filter += "AND buildqueue.owner = '%s'" % (re.sub("[\"']", "", self.owner))
 
 	if self.revision:
-            filter += "AND buildqueue.revision = '%s'" % (self.revision)
+            filter += "AND buildqueue.revision = %s" % (int(self.revision))
 
         return filter