storm/minidlna
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- SQL escape user input in TiVo command processing.

Browse Source
This commit is contained in:
Justin Maggard 2013-04-03 00:26:54 +00:00
parent ba75f275e1
commit cd20aa0b24
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
tivo_commands.c
View File

@ -394,7 +394,7 @@ SendContainer(struct upnphttp *h, const char *objectID, int itemStart, int itemC
} }
else else
{ {
item = sql_get_text_field(db, "SELECT NAME from OBJECTS where OBJECT_ID = '%s'", objectID); item = sql_get_text_field(db, "SELECT NAME from OBJECTS where OBJECT_ID = '%q'", objectID);
if( item ) if( item )
{ {
title = escape_tag(item, 1); title = escape_tag(item, 1);
@ -406,12 +406,12 @@ SendContainer(struct upnphttp *h, const char *objectID, int itemStart, int itemC
if( recurse ) if( recurse )
{ {
xasprintf(&which, "OBJECT_ID glob '%s$*'", objectID); which = sqlite3_mprintf("OBJECT_ID glob '%q$*'", objectID);
strcpy(groupBy, "group by DETAIL_ID"); strcpy(groupBy, "group by DETAIL_ID");
} }
else else
{ {
xasprintf(&which, "PARENT_ID = '%s'", objectID); which = sqlite3_mprintf("PARENT_ID = '%q'", objectID);
} }
if( sortOrder ) if( sortOrder )
@ -631,8 +631,8 @@ SendContainer(struct upnphttp *h, const char *objectID, int itemStart, int itemC
DPRINTF(E_ERROR, L_HTTP, "SQL error: %s\n", zErrMsg); DPRINTF(E_ERROR, L_HTTP, "SQL error: %s\n", zErrMsg);
sqlite3_free(zErrMsg); sqlite3_free(zErrMsg);
Send500(h); Send500(h);
sqlite3_free(which);
free(title); free(title);
free(which);
free(resp); free(resp);
return; return;
} }
@ -653,7 +653,7 @@ SendContainer(struct upnphttp *h, const char *objectID, int itemStart, int itemC
memcpy(str.data, &str_buf, ret); memcpy(str.data, &str_buf, ret);
str.size = str.off+ret; str.size = str.off+ret;
free(title); free(title);
free(which); sqlite3_free(which);
BuildResp_upnphttp(h, str.data, str.size); BuildResp_upnphttp(h, str.data, str.size);
free(resp); free(resp);
SendResp_upnphttp(h); SendResp_upnphttp(h);
@ -763,7 +763,8 @@ ProcessTiVoCommand(struct upnphttp *h, const char *orig_path)
} }
else else
{ {
SendContainer(h, container, itemStart, itemCount, anchorItem, anchorOffset, recurse, sortOrder, filter, randomSeed); SendContainer(h, container, itemStart, itemCount, anchorItem,
anchorOffset, recurse, sortOrder, filter, randomSeed);
} }
} }
else if( strcmp(command, "QueryItem") == 0 ) else if( strcmp(command, "QueryItem") == 0 )