Changeset 3688 for wikirenameplugin

Show
Ignore:
Timestamp:
05/16/08 10:57:28 (8 months ago)
Author:
coderanger
Message:

Remove some long-standing security issues.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • wikirenameplugin/0.11/wikirename/util.py

    r3617 r3688  
    4242        'WHERE w1.version = w2.max_version AND w1.name = w2.name ' 
    4343 
    44     sql = 'SELECT w1.version,w1.text' + sqlbase + 'AND w1.name = \'%s\'' % oldname 
     44    sql = 'SELECT w1.version,w1.text' + sqlbase + 'AND w1.name = %s' 
    4545    debug('Running query %r', sql) 
    46     cursor.execute(sql) 
     46    cursor.execute(sql, (oldname,)) 
    4747 
    4848    row = cursor.fetchone() 
    …… 
    7676    # Get a list of all wiki pages containing links to the old page 
    7777    debug("Trying to fix links") 
    78     sql = 'SELECT w1.version,w1.name,w1.text' + sqlbase + "AND w1.text like '%%[wiki:%s%%'" % oldname 
     78    sql = 'SELECT w1.version,w1.name,w1.text' + sqlbase + 'AND w1.text like %s' 
    7979    debug('Running query %r', sql) 
    80     cursor.execute(sql) 
     80    cursor.execute(sql, ('%[wiki:'+oldname+'%',)) 
    8181 
    8282    # Rewrite all links to the old page, such as to point to the new page