Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×

Comment Re:Heh (Score 5, Informative) 54

It looks like a feature where you could supply one placeholder in a prepared statement, but give it an array of values, and it would expand the placeholders to fit the array. So if the query was like this:

SELECT * FROM table WHERE id IN (:idlist)

and you passed an array with 3 values for idlist, it would replace the query like this:

SELECT * FROM table WHERE id IN (:idlist_1, :idlist_2, :idlist_3) ... then use the values in the array as the three values for those placeholders. It looks like the old code was using the keys from the data array, so instead of appending someting like "_1", it would append the actual key. So an attacker could put SQL code into the array keys and it would stick those (unchanged) into the query.

Here is the old code (without comments):

foreach (array_filter($args, 'is_array') as $key => $data) {
            $new_keys = array();
            foreach ($data as $i => $value) {
                $new_keys[$key . '_' . $i] = $value;
            }
            $query = preg_replace('#' . $key . '\b#', implode(', ', array_keys($new_keys)), $query);

And the new code:

foreach (array_filter($args, 'is_array') as $key => $data) {
            $new_keys = array();
            foreach (array_values($data) as $i => $value) {
                $new_keys[$key . '_' . $i] = $value;
            }
            $query = preg_replace('#' . $key . '\b#', implode(', ', array_keys($new_keys)), $query);

array_values will return an array with numeric indexes, which is what removes the vulnerability.

Comment Re:German illegal? (Score 2) 323

And this isn't old news either - that a Presidential candidate (JFK) was Catholic was a divisive issue within living memory.

The problem with knowing the truth of US history is, starting in the 60's the black civil rights movement co-opted the idea of discrimination and painted in simple black-and-white terms. Steadily since then, except for things like the internment of the Japanese that simply couldn't be overwritten, the story of discrimination and persecution in the US has been told solely in terms of antisemitism and Jim Crow.

Comment Re:For everything there is a season (Score 2, Insightful) 228

Ebola is easy to stop. We have oceans to protect us. All we need to do is stop allowing the 25,000 VISAS from affected countries from being used to gain entry.

1. Person from Ebola Land travels to Europe or some other non-US country, and exposes a person who is not from Ebola Land, who then travels home to the US.

2. US citizen travels to and from Ebola Land.

There are many different ways that Ebola can reach out and touch people who are not from Ebola Land, shutting down foreign visas is not the solution.

Comment Re:Reasonable (Score 1) 144

Riiight. Because US sex offenders lists contain people who made the mistake of drunkenly pissing against a wall in public...

Bullshit. Cite a reliable news source on that one.

Not to mention that US laws actually allows the prosecution of minors when their nude shot of themselves gets into the public internet.

We're talking about Google's response to the European "right to be forgotten", not US laws.

Can you stay on-topic? Or are you one of these one-topic fanatics that tie every subject into your obsession?

Comment Re:It must be running out of fuel (Score 1) 81

I don't see any claim that they "need" to bring it back, just that they "are" bringing it back. Considering that its stated mission is to test various technologies, maybe they want to change the payload out. Maybe the mission ended. Apparently the other two missions did not end because of a lack of fuel.

Slashdot Top Deals

"Experience has proved that some people indeed know everything." -- Russell Baker

Working...