sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Use DB prepare on login queries. Props filosofo. fixes #6640 for trunk

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@7633 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Ryan Boren 2008-04-08 17:30:14 +00:00
parent f9290af15d
commit 9087912f89
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
wp-login.php
View File

@ -90,13 +90,13 @@ function retrieve_password() {
do_action('retreive_password', $user_login); // Misspelled and deprecated do_action('retreive_password', $user_login); // Misspelled and deprecated
do_action('retrieve_password', $user_login); do_action('retrieve_password', $user_login);
$key = $wpdb->get_var("SELECT user_activation_key FROM $wpdb->users WHERE user_login = '$user_login'"); $key = $wpdb->get_var($wpdb->prepare("SELECT user_activation_key FROM $wpdb->users WHERE user_login = %s", $user_login));
if ( empty($key) ) { if ( empty($key) ) {
// Generate something random for a key... // Generate something random for a key...
$key = wp_generate_password(); $key = wp_generate_password();
do_action('retrieve_password_key', $user_login, $key); do_action('retrieve_password_key', $user_login, $key);
// Now insert the new md5 key into the db // Now insert the new md5 key into the db
$wpdb->query("UPDATE $wpdb->users SET user_activation_key = '$key' WHERE user_login = '$user_login'"); $wpdb->query($wpdb->prepare("UPDATE $wpdb->users SET user_activation_key = %s WHERE user_login = %s", $key, $user_login));
} }
$message = __('Someone has asked to reset the password for the following site and username.') . "\r\n\r\n"; $message = __('Someone has asked to reset the password for the following site and username.') . "\r\n\r\n";
$message .= get_option('siteurl') . "\r\n\r\n"; $message .= get_option('siteurl') . "\r\n\r\n";
@ -118,7 +118,7 @@ function reset_password($key) {
if ( empty( $key ) ) if ( empty( $key ) )
return new WP_Error('invalid_key', __('Invalid key')); return new WP_Error('invalid_key', __('Invalid key'));
$user = $wpdb->get_row("SELECT * FROM $wpdb->users WHERE user_activation_key = '$key'"); $user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE user_activation_key = %s", $key));
if ( empty( $user ) ) if ( empty( $user ) )
return new WP_Error('invalid_key', __('Invalid key')); return new WP_Error('invalid_key', __('Invalid key'));