ipfspics/ipfspics-server

sqlinjection

victorb opened this issue · 2 comments

victorb commented

Seems there are some possibilities for people to do injections.

https://github.com/ipfspics/server/blob/master/preview.php#L21

$hash is coming directly from $_GET which is no good.

cloutier commented

The code exits if someone tries to input something that isn't a valid IPFS hash.

    if (preg_match('/^([A-z0-9])+$/', $_GET['hash']) ) {
        $hash = $_GET['hash'];
    } else {
        exit("wrong hash");
    }

I know it's maybe not the cleanest way to do this. I really need to add comments to the code.
HTML code is also properly escaped in the albums.

Thanks a lot for checking our code though 😄 it really helps us!

victorb commented

Ah, my bad for missing that! Thanks for the quick reply though!