Just spotted this in the latest dev snapshot and it looks like an oversight -- one of the select queries uses the q parameter without any escaping, making it trivial to trick admins into executing arbitrary queries if you can get them to click on a link to a path with an admin-notes block in use.

Rolling a patch in a moment.

CommentFileSizeAuthor
#1 unescaped-query-1121344-2.patch586 byteseaton

Comments

eaton’s picture

eaton commented
StatusFileSize
new unescaped-query-1121344-2.patch586 bytes

Aaaand here's the patch.

eaton’s picture

eaton commented
Status: Active » Needs review
aaron’s picture

aaron commented
Status: Needs review » Fixed

holy s***! thanks for catching that, @eaton. fixed & committed.

eaton’s picture

eaton commented

No sweat, I saw that all the other queries were escaping things properly, so I figured it was just a mistake that slipped through. Thanks for the slick module!

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.