Changeset 50c848a

Timestamp:

08/30/17 19:44:17 (5 years ago)

Author:

Philipp Spitzer <philipp@…>

Branches:

master, qt5

Children:

e27a3f5

Parents:

511ff7e

git-author:

Martín Ferrari <tincho@…> (08/28/17 00:05:04)

git-committer:

Philipp Spitzer <philipp@…> (08/30/17 19:44:17)

Message:

Fix possibility for SQL injection attack.

File:

• src/mvc/track.cpp (modified) (1 diff)

src/mvc/track.cpp

@@ -41 +41 @@
     QSqlQuery query;
     QString trackname = name();
-    query.prepare("INSERT INTO " + sTableName + " (" + CONFERENCEID + "," + NAME + ")" + " VALUES " + "(\"" + QString::number(conferenceid()) + "\",\"" + trackname + "\")");
+    query.prepare(
+            QString("INSERT INTO %1 (%2, %3) VALUES (:xid_conference, :name)")
+            .arg(sTableName, CONFERENCEID, NAME));
+    query.bindValue(":xid_conference", conferenceid());
+    query.bindValue(":name", trackname);
     if (!query.exec())
     {
-        throw TrackInsertException("Inserting track '" + trackname + "' into database failed.");
+        throw TrackInsertException(
+                "Inserting track '" + trackname + "' into database failed: " +
+                query.lastError().text());
     }
     QVariant variant = query.lastInsertId();