summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorNeil Drumm2007-12-05 21:09:33 +0000
committerNeil Drumm2007-12-05 21:09:33 +0000
commit3496e7944bb8f10780f1831ce32cf8ac0500217f (patch)
tree4476f3675d3c7abebac730c807aecc77304a7822
parent4a578d7ac2f8b3b25bf57b9f90af57b1ce7f18c6 (diff)
Drupal 4.7.9.4.7.9
-rw-r--r--CHANGELOG.txt4
-rw-r--r--modules/system.module2
-rw-r--r--modules/taxonomy.module16
3 files changed, 15 insertions, 7 deletions
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index e7d28ab..b419e65 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -1,5 +1,9 @@
// $Id$
+Drupal 4.7.9, 2007-12-05
+------------------------
+- fixed a security issue (SQL injection), see SA-2007-031
+
Drupal 4.7.8, 2007-10-17
----------------------
- fixed a security issue (HTTP response splitting), see SA-2007-024
diff --git a/modules/system.module b/modules/system.module
index f173c0b..49a7610 100644
--- a/modules/system.module
+++ b/modules/system.module
@@ -6,7 +6,7 @@
* Configuration system that lets administrators modify the workings of the site.
*/
-define('VERSION', '4.7.9 dev');
+define('VERSION', '4.7.9');
/**
* Implementation of hook_help().
diff --git a/modules/taxonomy.module b/modules/taxonomy.module
index 4b18b6b..a538b43 100644
--- a/modules/taxonomy.module
+++ b/modules/taxonomy.module
@@ -1104,16 +1104,20 @@ function taxonomy_select_nodes($tids = array(), $operator = 'or', $depth = 0, $p
}
if ($operator == 'or') {
- $str_tids = implode(',', call_user_func_array('array_merge', $descendant_tids));
- $sql = 'SELECT DISTINCT(n.nid), n.sticky, n.title, n.created FROM {node} n INNER JOIN {term_node} tn ON n.nid = tn.nid WHERE tn.tid IN ('. $str_tids .') AND n.status = 1 AND n.moderate = 0 ORDER BY '. $order;
- $sql_count = 'SELECT COUNT(DISTINCT(n.nid)) FROM {node} n INNER JOIN {term_node} tn ON n.nid = tn.nid WHERE tn.tid IN ('. $str_tids .') AND n.status = 1 AND n.moderate = 0';
+ $args = call_user_func_array('array_merge', $descendant_tids);
+ $placeholders = implode(',', array_fill(0, count($args), '%d'));
+ $sql = 'SELECT DISTINCT(n.nid), n.sticky, n.title, n.created FROM {node} n INNER JOIN {term_node} tn ON n.nid = tn.nid WHERE tn.tid IN ('. $placeholders .') AND n.status = 1 AND n.moderate = 0 ORDER BY '. $order;
+ $sql_count = 'SELECT COUNT(DISTINCT(n.nid)) FROM {node} n INNER JOIN {term_node} tn ON n.nid = tn.nid WHERE tn.tid IN ('. $placeholders .') AND n.status = 1 AND n.moderate = 0';
}
else {
+ $args = array();
$joins = '';
$wheres = '';
foreach ($descendant_tids as $index => $tids) {
$joins .= ' INNER JOIN {term_node} tn'. $index .' ON n.nid = tn'. $index .'.nid';
- $wheres .= ' AND tn'. $index .'.tid IN ('. implode(',', $tids) .')';
+ $placeholders = implode(',', array_fill(0, count($tids), '%d'));
+ $wheres .= ' AND tn'. $index .'.tid IN ('. $placeholders .')';
+ $args = array_merge($args, $tids);
}
$sql = 'SELECT DISTINCT(n.nid), n.sticky, n.title, n.created FROM {node} n '. $joins .' WHERE n.status = 1 AND n.moderate = 0 '. $wheres .' ORDER BY '. $order;
$sql_count = 'SELECT COUNT(DISTINCT(n.nid)) FROM {node} n '. $joins .' WHERE n.status = 1 AND n.moderate = 0 ' . $wheres;
@@ -1121,10 +1125,10 @@ function taxonomy_select_nodes($tids = array(), $operator = 'or', $depth = 0, $p
$sql = db_rewrite_sql($sql);
$sql_count = db_rewrite_sql($sql_count);
if ($pager) {
- $result = pager_query($sql, variable_get('default_nodes_main', 10), 0, $sql_count);
+ $result = pager_query($sql, variable_get('default_nodes_main', 10), 0, $sql_count, $args);
}
else {
- $result = db_query_range($sql, 0, variable_get('feed_default_items', 10));
+ $result = db_query_range($sql, 0, variable_get('feed_default_items', 10), $args);
}
}