Sandbox

If I open http://joomlacode.org/gf/project/ and search, for instance, "Joom!fish", I get an error page displaying the full SQL query. The error is due to the !. The query disclosure itself is a security risk, but if input is not sanitized and escaped correctly this could also lead to SQL injection, though I have not checked specifically whether Code is vulnerable to that.

To be more precise:

Enter * to return all
Could not execute query [Native Error: ERROR: syntax error] [User Info: SELECT headline(project.project_name, q) as project_name, headline(project.description, q) as description, project.project_id FROM project, projects_idx, to_tsquery('joom!fish') AS q WHERE (project.project_id=projects_idx.project_id AND (projects_idx.vectors @@ q)) ORDER BY rank(projects_idx.vectors, q) DESC]

I'll put on my to do list for the people of GForge.

I am a new joomla user, I have this message underneath my page. How do I solve or remove it. The page display very well but underneath this load meassage. the queries execution number keep changing.

34 queries executed
1
SET sql_mode = 'MYSQL40'--------------------------------------------------------------------------------2
SELECT folder, element, published, params
FROM jos_mambots
WHERE published >= 1
AND access <= 0
AND folder = 'system'
ORDER BY ordering--------------------------------------------------------------------------------3
SELECT id, link
FROM jos_menu
WHERE menutype = 'mainmenu'
AND published = 1
ORDER BY parent, ordering
LIMIT 1

@calltogreg:

Different issue. Please disable debug mode in the administrator backend, the queries will go away.

@endi

Brad notified the people of GForge. It's acknowledged that this is not correct behaviour, they could not find a way to exploit this with malicious code. Hope this will be fixed in a future release.

Thanks I did just that and it is out