WordPress.org
Get WordPress

Plugin Directory

Changeset 1649700


Ignore:
Timestamp:
05/02/2017 02:05:49 PM (9 years ago)
Author:
hovida
Message:

Prevent SQL Injections, updating data saving

Location:
category-thumbnails/trunk
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • category-thumbnails/trunk/category-thumbnails.php

    r879146 r1649700  
    66        Author:             Adrian Preuss
    77        Author URI:         mailto:support@hovida-design.de?Subject=WordPress%20category-thumbnails
    8         Version:            1.0.5
     8        Version:            1.0.6
    99        Text Domain:        category-thumbnails
    1010        Domain Path:        /languages
    … …  
    211211            }
    212212           
    213             $wpdb->query(sprintf('UPDATE `%sterm_taxonomy` SET `term_thumbnail`=%s WHERE `term_id`=\'%s\' LIMIT 1', $wpdb->prefix, (empty($data) ? 'NULL' : sprintf('\'%s\'', base64_decode($data))), $category));
     213            if($data !== NULL) {
     214                $data = base64_decode($data);
     215            }
     216           
     217            $wpdb->update($wpdb->prefix . 'term_taxonomy', array(
     218                'term_thumbnail' => $data
     219            ), array(
     220                'term_id' => $category
     221            ));
    214222        }
    215223    }

  • category-thumbnails/trunk/public_api.php

    r879146 r1649700  
    1818        }
    1919       
    20         $result = $wpdb->get_row(sprintf('SELECT `term_thumbnail` FROM `%sterm_taxonomy` WHERE `term_id`=\'%d\' LIMIT 1', $wpdb->prefix, $cat));
     20        $result = $wpdb->get_row($wpdb->prepare('SELECT `term_thumbnail` FROM `%sterm_taxonomy` WHERE `term_id`=%d LIMIT 1', $wpdb->prefix, $cat));
    2121        return $result->term_thumbnail != null ? true : false;
    2222    }
    … …  
    3535       
    3636        $attributes     = array();
    37         $result         = $wpdb->get_row(sprintf('SELECT `term_thumbnail` FROM `%sterm_taxonomy` WHERE `term_id`=\'%d\' LIMIT 1', $wpdb->prefix, $cat));
     37        $result         = $wpdb->get_row($wpdb->prepare('SELECT `term_thumbnail` FROM `%sterm_taxonomy` WHERE `term_id`=%d LIMIT 1', $wpdb->prefix, $cat));
    3838        $data           = json_decode($result->term_thumbnail);
    3939       
    … …  
    6464        }
    6565       
    66         $result         = $wpdb->get_row(sprintf('SELECT `term_thumbnail` FROM `%sterm_taxonomy` WHERE `term_id`=\'%d\' LIMIT 1', $wpdb->prefix, $cat));
     66        $result         = $wpdb->get_row($wpdb->prepare('SELECT `term_thumbnail` FROM `%sterm_taxonomy` WHERE `term_id`=%d LIMIT 1', $wpdb->prefix, $cat));
    6767        $data           = json_decode($result->term_thumbnail);
    6868       

  • category-thumbnails/trunk/readme.txt

    r879149 r1649700  
    11=== Category Thumbnails ===
    22Contributors: Adrian Preuss
    3 Version: 1.0.5
     3Version: 1.0.6
    44Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=H56DKPMQE49NJ
    55Tags: category, thumbnail, taxonomy, custom
Note: See TracChangeset for help on using the changeset viewer.