Problem/Motivation

\Drupal\tmgmt_content\ContentEntitySourcePluginUi::buildTranslatableEntitiesQuery() uses unsanitized user input to filter out translations on the source overview page.

Proposed resolution

Sanitize the user input before executing a database query. The best would be to refactor \Drupal\tmgmt_content\ContentEntitySourcePluginUi::buildTranslatableEntitiesQuery() to use Entity API instead if possible.

Remaining tasks

User interface changes

API changes

Data model changes

CommentFileSizeAuthor
#3 use-db-like-helper-function-2982338-3.patch1.27 KBmbovan

Comments

mbovan created an issue. See original summary.

mbovan’s picture

mbovan commented
Priority: Major » Normal

There is https://cgit.drupalcode.org/tmgmt/tree/sources/content/src/ContentEntity... actually that has an allowed list of keys that can be used for filtering the content, so lowering the priority.

mbovan’s picture

mbovan commented
Status: Active » Needs review
StatusFileSize
new use-db-like-helper-function-2982338-3.patch1.27 KB

As suggested by @Berdir, we can use db_like() functio for such purposes.

  • Berdir committed 1bd7b97 on 8.x-1.x authored by mbovan 
    Issue #2982338 by mbovan: Sanitize the user input before executing a...
berdir’s picture

berdir
Primary language German
Location Switzerland
commented
Status: Needs review » Needs work

I committed this, but just now realized that db_like() is deprecated.

berdir’s picture

berdir
Primary language German
Location Switzerland
commented
Status: Needs work » Fixed

Fixed elsewhere.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.