Changeset 10942

Timestamp:

May 19, 2011, 5:28:40 PM (13 years ago)

Author:

Eric

Message:

use pwg_db_real_escape_string() instead of addslashes()
version 2.20.7 hard coded

Location:

extensions/UserAdvManager/trunk

Files:

• admin/UAM_admin.php (modified) (2 diffs)
• changelog.txt.php (modified) (1 diff)
• include/upgradedb.inc.php (modified) (7 diffs)
• main.inc.php (modified) (1 diff)
• maintain.inc.php (modified) (2 diffs)

extensions/UserAdvManager/trunk/admin/UAM_admin.php

@@ -186 +186 @@
                 $query = '
                 UPDATE '.CONFIG_TABLE.'
-                SET value="'.addslashes($conf['UserAdvManager']).'"
+                SET value="'.pwg_db_real_escape_string($conf['UserAdvManager']).'"
                 WHERE param="UserAdvManager"
                 LIMIT 1
@@ -215 +215 @@
           $query = '
       UPDATE '.CONFIG_TABLE.'
-                        SET value="'.addslashes($conf['UserAdvManager_ConfirmMail']).'"
+                        SET value="'.pwg_db_real_escape_string($conf['UserAdvManager_ConfirmMail']).'"
                         WHERE param="UserAdvManager_ConfirmMail"
                         LIMIT 1

extensions/UserAdvManager/trunk/changelog.txt.php

@@ -248 +248 @@
 -- 2.20.6 : Improve database update process
             Bug 2289 fixed - "Password in clear text in the information email" was working in a reverse logic
+
+-- 2.20.7 : Use pwg_db_real_escape_string() instead of addslashes()
 */
 ?>

extensions/UserAdvManager/trunk/include/upgradedb.inc.php

@@ -180 +180 @@
   $query = '
 UPDATE '.CONFIG_TABLE.'
-  SET value = "'.addslashes(serialize($upgrade_UAM)).'"
+  SET value = "'.pwg_db_real_escape_string(serialize($upgrade_UAM)).'"
   WHERE param = "nbc_UserAdvManager"
 ;';
@@ -191 +191 @@
     $query = '
 UPDATE '.CONFIG_TABLE.'
-  SET value = "'.addslashes(serialize($data)).'"
+  SET value = "'.pwg_db_real_escape_string(serialize($data)).'"
   WHERE param = "nbc_UserAdvManager_ConfirmMail"
 ;';
@@ -241 +241 @@
   $query = '
       UPDATE '.CONFIG_TABLE.'
-                        SET value="'.addslashes($update_conf).'"
+                        SET value="'.pwg_db_real_escape_string($update_conf).'"
                         WHERE param="UserAdvManager_ConfirmMail"
                         LIMIT 1
@@ -297 +297 @@
   $query = '
       UPDATE '.CONFIG_TABLE.'
-                        SET value="'.addslashes($update_conf).'"
+                        SET value="'.pwg_db_real_escape_string($update_conf).'"
                         WHERE param="UserAdvManager"
                         LIMIT 1
@@ -343 +343 @@
   $query = '
       UPDATE '.CONFIG_TABLE.'
-                        SET value="'.addslashes($update_conf).'"
+                        SET value="'.pwg_db_real_escape_string($update_conf).'"
                         WHERE param="UserAdvManager"
                         LIMIT 1
@@ -389 +389 @@
   $query = '
 UPDATE '.CONFIG_TABLE.'
-SET value="'.addslashes($update_conf).'"
+SET value="'.pwg_db_real_escape_string($update_conf).'"
 WHERE param="UserAdvManager"
 LIMIT 1
@@ -446 +446 @@
   $query = '
 UPDATE '.CONFIG_TABLE.'
-SET value="'.addslashes($update_conf).'"
+SET value="'.pwg_db_real_escape_string($update_conf).'"
 WHERE param="UserAdvManager"
 LIMIT 1

extensions/UserAdvManager/trunk/main.inc.php

@@ -2 +2 @@
 /*
 Plugin Name: UserAdvManager
-Version: 2.20.6
+Version: 2.20.7
 Description: Renforcer la gestion des utilisateurs - Enforce users management
 Plugin URI: http://piwigo.org/ext/extension_view.php?eid=216

extensions/UserAdvManager/trunk/maintain.inc.php

@@ -35 +35 @@
     $q = '
 INSERT INTO '.CONFIG_TABLE.' (param, value, comment)
-VALUES ("UserAdvManager","'.addslashes(serialize($default1)).'","UAM parameters")
+VALUES ("UserAdvManager","'.pwg_db_real_escape_string(serialize($default1)).'","UAM parameters")
   ;';
     pwg_query($q);
@@ -62 +62 @@
     $q = '
 INSERT INTO '.CONFIG_TABLE.' (param, value, comment)
-VALUES ("UserAdvManager_ConfirmMail","'.addslashes(serialize($default2)).'","UAM ConfirmMail parameters")
+VALUES ("UserAdvManager_ConfirmMail","'.pwg_db_real_escape_string(serialize($default2)).'","UAM ConfirmMail parameters")
   ;';
     pwg_query($q);