Christophe Beauregard <[email protected]> wrote: > On Tue, Jan 5, 2010 at 2:22 PM, Jeremy Cowgar <[email protected]> wrote: > > I'm the one who implemented cgi() in CVSTrac... basically, the report > output query is wrapped in a SQLite database authorizer which > prohibits anything except read access to tables and fields the user is > allowed to see. In terms of code, it would be the access_authorizer() > function in http://www.cvstrac.org/cvstrac/fileview?f=cvstrac/db.c. > It's also layered below the query_authorizer() function which > restricts reports to only SELECT operations. > > And the CGI parameter is probably quoted for sanity. > > It looked like Richard used this approach as a model in Fossil last > time I glanced at the source. SQL injection attacks against CVSTrac > and Fossil would pretty much require deliberate effort on the parts of > the developers... >
That's good to hear. Jeremy _______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
