Open GoogleCodeExporter opened 9 years ago
I discovered that my patch destroys the feed importing function, so
unfortunately the bug will have to be fixed in add-tag.php. I've attached a new
patch.
Original comment by dmazz...@gmail.com
on 18 May 2011 at 6:18
Attachments:
Thanks for pointing this out. I think I will fix the XSS by using
htmlentites() at output time, rather than in fof_safe_query.
You also mentioned SQL injection. I believe that because of the code in
fof_safe_query and the way the queries are constructed, I am already safe from
SQL injection. Please let me know if you think otherwise!
Original comment by stevemin...@gmail.com
on 22 May 2011 at 6:06
I believe you are safe from someone injecting malicious SQL statements, but in
my opinion htmlentities should be used before something is inserted into the
database. Tags are displayed in multiple places, like the sidebar and on each
tagged post. But if you find all of those places, then I guess that is fine
too.
The patch that I attached in my comment (add-tag.diff) fixes the problem before
a tag name is inserted.
Original comment by dmazz...@gmail.com
on 22 May 2011 at 6:09
Original issue reported on code.google.com by
dmazz...@gmail.com
on 18 May 2011 at 9:14Attachments: