From 7a13338b4c9ee0f421a9e182e83cb2d8f458774e Mon Sep 17 00:00:00 2001 From: Andrew Dolgov Date: Mon, 19 Oct 2009 23:29:45 +0400 Subject: [PATCH] fix proper escaping of label titles (closes #255) --- modules/backend-rpc.php | 6 ++++-- modules/pref-labels.php | 2 ++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/modules/backend-rpc.php b/modules/backend-rpc.php index 3e4a9434..1a65efc0 100644 --- a/modules/backend-rpc.php +++ b/modules/backend-rpc.php @@ -450,7 +450,8 @@ $ids = split(",", db_escape_string($_REQUEST["ids"])); $label_id = db_escape_string($_REQUEST["lid"]); - $label = label_find_caption($link, $label_id, $_SESSION["uid"]); + $label = db_escape_string(label_find_caption($link, $label_id, + $_SESSION["uid"])); print ""; print ""; @@ -485,7 +486,8 @@ $ids = split(",", db_escape_string($_REQUEST["ids"])); $label_id = db_escape_string($_REQUEST["lid"]); - $label = label_find_caption($link, $label_id, $_SESSION["uid"]); + $label = db_escape_string(label_find_caption($link, $label_id, + $_SESSION["uid"])); print ""; diff --git a/modules/pref-labels.php b/modules/pref-labels.php index 33622880..02e5a2be 100644 --- a/modules/pref-labels.php +++ b/modules/pref-labels.php @@ -61,6 +61,8 @@ /* Update filters that reference label being renamed */ + $old_caption = db_escape_string($old_caption); + db_query($link, "UPDATE ttrss_filters SET action_param = '$caption' WHERE action_param = '$old_caption' AND action_id = 7 -- 2.39.5