Re: [AppDB] Implement maintainer ratings.

[Paul van Schayck]

Hey Tony,

Few comments.
> -
>   maintainer_rating  text,
> -
>   maintainer_release text,

Why text, why not a varchar of 100 characters. It doesn't matter that
much but it just optimizes our code a bit.
> -
>    $versionName   = addslashes($_REQUEST['versionName']);
> -
>    $description   = addslashes($_REQUEST['description']);
> -
>    $webPage       = addslashes($_REQUEST['webPage']);
> -
>    $versionName        = addslashes($_REQUEST['versionName']);
> -
>    $keywords           = $_REQUEST['keywords'];
> -
>    $description        = addslashes($_REQUEST['description']);
> -
>    $webPage            = addslashes($_REQUEST['webPage']);
> -
>    $maintainer_rating  = $_REQUEST['maintainer_rating'];
> -
>    $maintainer_release = $_REQUEST['maintainer_release'];
>      //did anything change?
>      if ($VersionChanged)
>      {
>          $query = "UPDATE appVersion SET versionName = '".$versionName."', ".
>              "keywords = '".$_REQUEST['keywords']."', ".
>              "description = '".$description."', ".
> -
>            "webPage = '".$webPage."'".
> -
>            "webPage = '".$webPage."',".
> -
>            "maintainer_rating = '".$maintainer_rating."',".
> -
>            "maintainer_release = '".$maintainer_release."'".
>            " WHERE appId = ".$_REQUEST['appId']." and versionId = ".$_REQUEST['versionId'];
>        if (mysql_query($query))
>        {

This is far from sql injection safe. Anyone can enter anything into
$_REQUEST['mantainer_release'] or $_REQUEST['mantainer_rating'] and
change any field from the appVersion table. It isn't a real problem in
this case because they can already change most fields as maintainer.
But they can for example change the versionId to make an app-version
belong to any application.

To prevent this we should make our queries with the compile_*_string
functions from include/db.php. That function is doing addslashes. And
generates an as safe as possible query string. Usage can be seen in
admin/editAppFamily.php.

Also query_appdb should be used instead of mysql_query().

And appId and versionId should always be check with is_numeric().
Right now without giving out details it's possible to change any
application as long as you are maintainer of one application.

Will you fix it or shall I?

Paul