Browse Source

[svn r13847] Minor - Added a bit of filtering against SQL injection in get_all_document_data()

Yannick Warnier 17 years ago
parent
commit
92e1cd86a6
1 changed files with 3 additions and 1 deletions
  1. 3 1
      main/inc/lib/document.lib.php

+ 3 - 1
main/inc/lib/document.lib.php

@@ -500,7 +500,9 @@ class DocumentManager
 		}
 
 		//escape underscores in the path so they don't act as a wildcard
-		$path = str_replace('_', '\_', $path);
+		$path 		= Database::escape_string(str_replace('_', '\_', $path));
+		$to_user_id = Database::escape_string($to_user_id);
+		$to_value	= Database::escape_string($to_value);
 
 		//if they can't see invisible files, they can only see files with visibility 1
 		$visibility_bit = ' = 1';