浏览代码

[svn r13847] Minor - Added a bit of filtering against SQL injection in get_all_document_data()

Yannick Warnier 17 年之前
父节点
当前提交
92e1cd86a6
共有 1 个文件被更改,包括 3 次插入1 次删除
  1. 3 1
      main/inc/lib/document.lib.php

+ 3 - 1
main/inc/lib/document.lib.php

@@ -500,7 +500,9 @@ class DocumentManager
 		}
 
 		//escape underscores in the path so they don't act as a wildcard
-		$path = str_replace('_', '\_', $path);
+		$path 		= Database::escape_string(str_replace('_', '\_', $path));
+		$to_user_id = Database::escape_string($to_user_id);
+		$to_value	= Database::escape_string($to_value);
 
 		//if they can't see invisible files, they can only see files with visibility 1
 		$visibility_bit = ' = 1';