[patch] fix for sql injection and the crash problem in query_package.py

query_package.py.diff (text/plain), 606 bytes, created by Christian Hoffmann (RETIRED) on 2007-08-29 14:53:43 UTC

--- gentoo/src/packages/query_package.py	2005-10-04 03:51:29.000000000 +0200
+++ packages-fixes/query_package.py	2007-08-29 16:16:55.000000000 +0200
@@ -33,9 +33,12 @@
 
 
 form = cgi.FieldStorage()
-name = form.getvalue("name","")
-category = form.getvalue("category","")
-offset = form.getvalue("offset","0")
+name = form.getfirst("name","")
+category = form.getfirst("category","")
+try:
+    offset = int(form.getfirst("offset","0"))
+except ValueError:
+    offset = 0
 
 query = ('SELECT category,name,homepage,description,license '
     'FROM package WHERE category="%s"' % escape_string(category))