[Omero]

Bug found! If ' or " is present in the report text and the notify with PM is active, the mysql INSERT into private messages fail with mysql error!

Here is the workaround:

Change this:

PHP Code:


 if ($reporttomoderator == 2 || $reporttomoderator == 3) {
          eval("\$message = \"".gettemplate("pm_reportbadpost",1,0)."\";");
          eval("\$subject = \"".gettemplate("pmsubject_reportbadpost",1,0)."\";");
          $DB_site->query("INSERT INTO privatemessage (privatemessageid,userid,touserid,fromuserid,title,message,dateline,showsignature,iconid,messageread,folderid) VALUES (NULL,$moderator[userid],$moderator[userid],$bbuserinfo[userid],'$subject','$message',".time().",0,0,0,0)");
        } 


into this

PHP Code:

 if ($reporttomoderator == 2 || $reporttomoderator == 3) {
          eval("\$message = \"".gettemplate("pm_reportbadpost",1,0)."\";");
          eval("\$subject = \"".gettemplate("pmsubject_reportbadpost",1,0)."\";");
          $DB_site->query("INSERT INTO privatemessage (privatemessageid,userid,touserid,fromuserid,title,message,dateline,showsignature,iconid,messageread,folderid) VALUES (NULL,$moderator[userid],$moderator[userid],$bbuserinfo[userid],'$subject','".addslashes($message)."',".time().",0,0,0,0)");
        } 


This will fix the bug, by adding the proper slashes where they are needed