search

directus / v8-archive

Directus Database API — Wraps Custom SQL Databases with a REST/GraphQL API
https://docs.directus.io/api/reference.html
507 stars 204 forks source link

Escape character sequence on password input #2063

Open InfamousStarFox opened 4 years ago

InfamousStarFox commented 4 years ago

Directus version: 8.8.1 LAMP Stack: Shared Hosting, PHP 7.4 MySQL 5.6

In the basic installation steps, on the "Database User Password", the recorded corresponding string in /config/{project-name}.php is non-escaped, allowing password entrys which use a single quotation mark to escape out of the object, causing setup to fail.

InfamousStarFox commented 4 years ago

The function replacePlaceholder in file /src/core/Directus/Util/StringUtils.php, specifically line 249 is the culprit which needs to be updated to properly sanitize against escape characters.