Bug #478

LiveUser_Admin_Auth_Container_DB::getUsers, column name restrictions

Details

Submitted	2003-12-22 15:03 UTC
From	jmikola at burgiss dot com
Status	Bogus
Package	LiveUser
PHP Version	Irrelevant
OS	ANY
Roadmaps	(Not assigned)

Comments

[2003-12-22 15:03 UTC] jmikola at burgiss dot com

Description:
------------
The following suggestion was made by Laran Coates (LiveUser mailing list) regarding the security concern in the getUsers method where arbitrary data could be injected into the sql query, which expects field names for its select statement:

Couldn't we just put a note in the documentation with a guideline stating:

"Names of additional fields must begin with a character [A-Za-z] or an underscore [_] and may not contain any spaces."

From there it's just a matter of doing:

foreach($_fieldName as $_field) {
if (!preg_match("/^(\w+)/",$_field)) {
trigger_error("invalid field name \"$_field\"");
}
}