You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Milan Kyselica 0a86e45e8c cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection ... The eventtype column handler in cel_pgsql.c inserts record.user_defined_name directly into the SQL query without calling PQescapeStringConn(), while all other string fields in the same function are properly escaped. Similarly, cel_tds.c passes the raw user_defined_name into the SQL INSERT without routing it through anti_injection(), while all other fields are processed through that function. For cel_pgsql.c, escape the eventtype value using PQescapeStringConn(), matching the existing pattern used for all other string fields at lines 308-331 of the same function. For cel_tds.c, route the eventtype value through anti_injection() consistent with how all other fields are handled in the same function. Resolves: #GHSA-ph27-3m5q-mj5m		4 months ago
..
Makefile	…
cel_beanstalkd.c	…
cel_custom.c	…
cel_manager.c	…
cel_odbc.c	…
cel_pgsql.c	cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection	4 months ago
cel_radius.c	…
cel_sqlite3_custom.c	…
cel_tds.c	cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection	4 months ago