Fix potential SQL Injection with postgis TIME filters (#4834)

MapServer · Dec 31, 2013 · 3a10f6b · 3a10f6b
1 parent e83a0cb
commit 3a10f6b
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/mappostgis.c b/mappostgis.c
@@ -3212,6 +3212,11 @@ int msPostGISLayerSetTimeFilter(layerObj *lp, const char *timestring, const char
   if (!lp || !timestring || !timefield)
     return MS_FALSE;
 
+  if( strchr(timestring,'\'') || strchr(timestring, '\\') ) {
+     msSetError(MS_MISCERR, "Invalid time filter.", "msPostGISLayerSetTimeFilter()");
+     return MS_FALSE;
+  }
+
   /* discrete time */
   if (strstr(timestring, ",") == NULL &&
       strstr(timestring, "/") == NULL) { /* discrete time */