Anonymous | Login
Project:
RSS
  
News | My View | View Issues | Roadmap | Summary

View Issue Details[ Jump to Notes ] [ Issue History ] [ Print ]
ID
0009074
TypeCategorySeverityReproducibilityDate SubmittedLast Update
defect[Openbravo ERP] A. Platformmajorhave not tried2009-05-18 15:342009-06-18 00:00
ReportershuehnerView Statuspublic 
Assigned Toshuehner 
PriorityurgentResolutionduplicateFixed in Version
StatusclosedFix in branchpiFixed in SCM revision
ProjectionnoneETAnoneTarget Version
OSAnyDatabaseAnyJava version
OS VersionDatabase versionAnt version
Product Version2.40SCM revision 
Merge Request Status
Review Assigned To
OBNetwork customerNo
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary

0009074: SQL injection in datagrid code

DescriptionThe datagrid code has issues where it is possible to inject code into the executed SQL statement via crafted parameters
TagsNo tags attached.
Attached Files

- Relationships [ Relation Graph ] [ Dependency Graph ]
duplicate of defect 0009501 closedshuehner Audit all xsql to ensure that all xsql-parameters of type argument/replace are properly validated -part1 
related to defect 0008579 closedshuehner SQL injection in selectors 
depends on feature request 0009500 closedshuehner Add infrastructure to VariablesBase class to allow for technical validation of request parameters 

-  Notes
(0017395)
shuehner (administrator)
2009-06-17 18:30

 First commit into 9501 does include fix for this issue.

- Issue History
Date Modified Username Field Change
2009-05-18 15:34 shuehner New Issue
2009-05-18 15:34 shuehner Assigned To => rafaroda
2009-05-18 15:34 shuehner OBNetwork customer => No
2009-05-18 15:34 shuehner Regression testing => No
2009-05-18 15:34 shuehner Relationship added related to 0008579
2009-05-20 12:05 psarobe Status new => scheduled
2009-05-20 12:05 psarobe Assigned To rafaroda => shuehner
2009-05-20 12:05 psarobe fix_in_branch => pi
2009-06-17 18:24 shuehner Relationship added depends on 0009500
2009-06-17 18:30 shuehner Relationship added duplicate of 0009501
2009-06-17 18:30 shuehner Status scheduled => closed
2009-06-17 18:30 shuehner Note Added: 0017395
2009-06-17 18:30 shuehner Duplicate ID 0 => 9501
2009-06-17 18:30 shuehner Resolution open => duplicate
2009-06-18 00:00 anonymous sf_bug_id 0 => 2807994

Copyright © 2000 - 2009 MantisBT Group
Powered by Mantis Bugtracker