Cross-db compatibility issues and possibility of SQL injection

[Ryan J Ollos]

As Steffen pointed out in the ​mailing list thread, the plugin doesn't follow the Trac guidelines for SQL statements, as described in ​t:TracDev/DatabaseApi#GuidelinesforSQLStatements. This will result in cross-db compatibility issues and the possibility of SQL injection.

Here is an example fix (untested, as I don't understand the plugin well enough to execute this pathway or write a test):

tracjsganttplugin/0.11/tracjsgantt/tracpm.py

@@ -2904 +2904 @@
                             values.append(t['id']) 
                             values.append(to_utimestamp(self.pm.start(t)))
                             values.append(to_utimestamp(self.pm.finish(t)))
-                    cursor.execute('INSERT INTO schedule' + \
-                                       ' (ticket, start, finish)' + \
-                                       ' VALUES %s' % valuesClause,
-                                   values)
-
+                    cursor.execute("""
+                        INSERT INTO schedule (ticket, start, finish)
+                        VALUES %%s""" % valuesClause, values)
 
                     # Finally, add history records to schedule_change
                     # for newly scheduled tickets.