On Tue, Jan 5, 2010 at 2:22 PM, Jeremy Cowgar <[email protected]> wrote: > I was thinking about this. Two things, it can only be inserted by someone > with report edit permissions but > it can be used by anyone executing that report. Thus, everything would have > to be escaped properly > otherwise you just opened all your internals to the world via SQL injection: > > http://repo?rptview?m=5&cgi_param=';DELETE FROM users;
<delurk> Not likely. I'm the one who implemented cgi() in CVSTrac... basically, the report output query is wrapped in a SQLite database authorizer which prohibits anything except read access to tables and fields the user is allowed to see. In terms of code, it would be the access_authorizer() function in http://www.cvstrac.org/cvstrac/fileview?f=cvstrac/db.c. It's also layered below the query_authorizer() function which restricts reports to only SELECT operations. And the CGI parameter is probably quoted for sanity. It looked like Richard used this approach as a model in Fossil last time I glanced at the source. SQL injection attacks against CVSTrac and Fossil would pretty much require deliberate effort on the parts of the developers... c. _______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
