You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Milan Kyselica 0a86e45e8c cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection ... The eventtype column handler in cel_pgsql.c inserts record.user_defined_name directly into the SQL query without calling PQescapeStringConn(), while all other string fields in the same function are properly escaped. Similarly, cel_tds.c passes the raw user_defined_name into the SQL INSERT without routing it through anti_injection(), while all other fields are processed through that function. For cel_pgsql.c, escape the eventtype value using PQescapeStringConn(), matching the existing pattern used for all other string fields at lines 308-331 of the same function. For cel_tds.c, route the eventtype value through anti_injection() consistent with how all other fields are handled in the same function. Resolves: #GHSA-ph27-3m5q-mj5m		2 months ago
..
Makefile	Remove as much trailing whitespace as possible.	9 years ago
cel_beanstalkd.c	progdocs: Remove outdated references in doxyref.h.	5 years ago
cel_custom.c	CDR/CEL Custom Performance Improvements	5 months ago
cel_manager.c	cel: Add missing manager documentation.	7 months ago
cel_odbc.c	odbc: Don't use prepared statements for distinct SQL statements	3 months ago
cel_pgsql.c	cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection	2 months ago
cel_radius.c	progdocs: Remove outdated references in doxyref.h.	5 years ago
cel_sqlite3_custom.c	CDR/CEL Custom Performance Improvements	5 months ago
cel_tds.c	cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection	2 months ago