Description

When a view has paging turned on the URL for the view will look something like this:
http://www.drupalsite.com/viewname/arg1?page=2

If the user manually enters "-1" after the equals sign, some very ugly MySQL errors appear. It might be worth considering if this is a security risk as well.

Repro Steps:
  1. Navigate to the url of a view with paging enabled (e.g., http://www.drupalsite.com/viewname/arg1?page=2)
  2. In the address bar of your browser, change the page to -1 and press Enter (e.g., http://www.drupalsite.com/viewname/arg1?page=-1)
Expected Result:

Page argument is rejected and view either defaults to the first page or displays nothing.

Actual Result:

The following errors are displayed in a yellow box with a green border.

  • Debug: 'Exception: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near \'-10\' at line 2' in views_plugin_query_default->execute() (line 1354 of websitedir/sites/all/modules/views/plugins/views_plugin_query_default.inc).
  • Debug: 'Exception: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near \'-50\' at line 2' in views_plugin_query_default->execute() (line 1354 of websitedir/sites/all/modules/views/plugins/views_plugin_query_default.inc).

Comments

merlinofchaos’s picture

Status: Active » Fixed

Easy fix. Committed.

Automatically closed -- issue fixed for 2 weeks with no activity.