News for hackers. Stuff that matters.

AlbertQQA

AlbertQQA on Hacker News

Re:Security vulnerability in #Drupal contrib module puts 120000 sites ... on Sunday April 16, 2017 @03:43AM (#14124840)
All I'm seeing is a missing db_like which means a user can search for "%foo%bar%" instead of just "foo%bar". This is not a SQL-injection, nor a relevant issue.

The problem is in that function though. It is missing a condition for publication status. Titles of unpublished nodes should render for some users, but not all.

Re:Security vulnerability in #Drupal contrib module puts 120000 sites ... on Friday April 14, 2017 @03:20PM (#14116516)
> Took hardly any time to see the SQL injection.

You sure you saw it correctly? Concatenation of hardcoded variants (poor-mans query builder) doesn't make an injection.