fixed security issue

Florian Schaal · Florian Schaal · commit 7ed87c51103a · 2013-10-21T22:03:13.000+02:00
diff --git a/server/lib/classes/db_mysql.inc.php b/server/lib/classes/db_mysql.inc.php
@@ -280,7 +280,7 @@ public function getDatabaseSize($database_name) {
                         return;
                 }
                 /* Get database-size from information_schema */
-                $result=mysql_query("SELECT SUM(data_length+index_length) FROM information_schema.TABLES WHERE table_schema='".$database_name."';",$link);
+		$result=mysql_query("SELECT SUM(data_length+index_length) FROM information_schema.TABLES WHERE table_schema='".mysql_real_escape_string($database_name)."';",$link);
                 $this->close;
                 if (!$result) {
                         $app->log('Unable to get the database-size'.mysql_error($link),LOGLEVEL_DEBUG);

Original file line number	Diff line number	Diff line change
`@@ -280,7 +280,7 @@ public function getDatabaseSize($database_name) {`
`280`	`280`	`return;`
`281`	`281`	`}`
`282`	`282`	`/* Get database-size from information_schema */`
`283`		`- $result=mysql_query("SELECT SUM(data_length+index_length) FROM information_schema.TABLES WHERE table_schema='".$database_name."';",$link);`
	`283`	`+ $result=mysql_query("SELECT SUM(data_length+index_length) FROM information_schema.TABLES WHERE table_schema='".mysql_real_escape_string($database_name)."';",$link);`
`284`	`284`	`$this->close;`
`285`	`285`	`if (!$result) {`
`286`	`286`	`$app->log('Unable to get the database-size'.mysql_error($link),LOGLEVEL_DEBUG);`