Escape data before using them in SQL

[nitriques]

This commit fixes a couple of possible SQLi errors.

Fixes #286

[michael-e]

I don't know which bugs are supposed to be fixed here. Do you have any test cases for me to try?

[nitriques]

@michael-e see #286 when Nils is searching for a user Director's cut

[nitriques]

Try to add some ' in any input and see if it breaks.

[michael-e]

Try to add some ' in any input and see if it breaks.

Even without your fix, using plain Symphony 2.6.11 and Members 1.6.0, I added ' to my Member name and was able to login nevertheless. Nothing broke. (However, the fact that my Member name was accepted doesn't feel very good, to be honest.)

I don't think that I understand all the issues well enough to do systematic testing here.

[jensscherbl]

I’m currently not using the members extension in any relevant project and don’t understand the code well enough to do a proper review and testing, sorry.

[nitriques]

No problems Jens thanks.

[nitriques]

@michael-e Nils also had problems with publish filtering I think. Nevertheless, the code needs those fixes.

[nitriques]

Just to make sure everybody's on the same page:

When I go in the members section, I filter by username with ', I get

The user does not see the end result, but can still do things like '; DROP sym_entries; --

Same thing happens with a datasource filtered by username usign {$url-q}. Issuing /?q=' crashes the datasource. The end user does not see any errors message (you have to hit /?q='&debug to see it, but it still allows a remote user to issue random SQL commands.

[nitriques]

If @nilshoerrmann could confirm that it fixes his problems, that would be cool ;)

[nilshoerrmann]

I sadly won't have time this week to look into this. Feel free to ping me again next week.

[michael-e]

@nitriques Thanks for the the explanation. It sounds like a severe issue to me, because it is not limited to backend users. We should release a hotfix version soon.

[nitriques]

Thanks @nilshoerrmann

@michael-e

It sounds like a severe issue to me

It is! I've warned everybody last June but never got the chance to actually patch it :(

[nitriques]

Version 1.7.0 is out