You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Milan Kyselica a04bee3992 cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection ... The eventtype column handler in cel_pgsql.c inserts record.user_defined_name directly into the SQL query without calling PQescapeStringConn(), while all other string fields in the same function are properly escaped. Similarly, cel_tds.c passes the raw user_defined_name into the SQL INSERT without routing it through anti_injection(), while all other fields are processed through that function. For cel_pgsql.c, escape the eventtype value using PQescapeStringConn(), matching the existing pattern used for all other string fields at lines 308-331 of the same function. For cel_tds.c, route the eventtype value through anti_injection() consistent with how all other fields are handled in the same function. Resolves: #GHSA-ph27-3m5q-mj5m		2 months ago
..
Makefile	Remove as much trailing whitespace as possible.	9 years ago
cel_beanstalkd.c	Initial commit for certified-22.8	6 months ago
cel_custom.c	cdr_custom: Allow absolute filenames.	2 years ago
cel_manager.c	cel: Add missing manager documentation.	7 months ago
cel_odbc.c	res_odbc: Use SQL_SUCCEEDED() macro where applicable.	7 months ago
cel_pgsql.c	cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection	2 months ago
cel_radius.c	Initial commit for certified-22.8	6 months ago
cel_sqlite3_custom.c	Initial commit for certified-22.8	6 months ago
cel_tds.c	cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection	2 months ago