3 ms·
> Took hardly any time to see the SQL injection. You sure you saw it correctly? Concatenation of hardcoded variants (poor-mans query builder) doesn't make an i
by AlbertQQA 9y ago
> Took hardly any time to see the SQL injection.
You sure you saw it correctly? Concatenation of hardcoded variants (poor-mans query builder) doesn't make an injection.
- lightlyused 9y agoI saw that one too, I think it is something in the node_references auto_complete menu task. To lazy to test, I've got plumbing work to do.
- AlbertQQA 9y agoAll I'm seeing is a missing db_like which means a user can search for "%foo%bar%" instead of just "foo%bar". This is not a SQL-injection, nor a relevant issue. The problem is in that function though. It is missing a condition for publication status. Titles of unpublished nodes should render for some users, but not all.
- lightlyused 9y agoWinner winner chicken dinner, https://www.reddit.com/r/drupal/comments/66bw8l/references_is_fixed/ https://www.reddit.com/r/drupal/comments/66bw8l/references_i...