-
-
Notifications
You must be signed in to change notification settings - Fork 204
Description
Bug Description
Tags URL uses the tag numerical IDs. I've tried for the fun of it to visit the tag URL using it's name/slug. It triggered an error 500.
Also, I don't know how the SQL is built, but this query:
select * from \"tags\" where \"id\" = mcp and \"tags\".\"deleted_at\" is null order by \"name\" asc limit 1)reeks of SQL injection. mcp should be quoted, and escaped.
How to reproduce
- add tag (mcp).
- go to /tags/mcp manually in the URL bar.
- an error message is shown.
Expected behavior
When using the tag name in the URL, the tag page is shown... or at best a 404 error.
Logs
Screenshots
CONTEXT: unnamed portal parameter $1 = '...' (Connection: pgsql, SQL: select * from "tags" where "id" = mcp and "tags"."deleted_at" is null order by "name" asc limit 1) at /app/ven
CONTEXT: unnamed portal parameter $1 = '...' (Connection: pgsql, SQL: select * from "tags" where "id" = mcp and "tags"."deleted_at" is null order by "name" asc limit 1) at /app/vendor/laravel/framework/src/Illuminate/Database/Connection.php:829)
[stacktrace]
#0 /app/vendor/laravel/framework/src/Illuminate/Database/Connection.php(783): Illuminate\Database\Connection->runQueryCallback('select * from "...', Array, Object(Closure))
#1 /app/vendor/laravel/framework/src/Illuminate/Database/Connection.php(414): Illuminate\Database\Connection->run('select * from "...', Array, Object(Closure))
#2 /app/vendor/laravel/framework/src/Illuminate/Database/Query/Builder.php(2913): Illuminate\Database\Connection->select('select * from "...', Array, true)
#3 /app/vendor/laravel/framework/src/Illuminate/Database/Query/Builder.php(2902): Illuminate\Database\Query\Builder->runSelect()
#4 /app/vendor/laravel/framework/src/Illuminate/Database/Query/Builder.php(3456): Illuminate\Database\Query\Builder->{closure:Illuminate\Database\Query\Builder::get():2901}()
#5 /app/vendor/laravel/framework/src/Illuminate/Database/Query/Builder.php(2901): Illuminate\Database\Query\Builder->onceWithColumns(Array, Object(Closure))
#6 /app/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Builder.php(739): Illuminate\Database\Query\Builder->get(Array)
#7 /app/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Builder.php(723): Illuminate\Database\Eloquent\Builder->getModels(Array)
#8 /app/vendor/laravel/framework/src/Illuminate/Database/Concerns/BuildsQueries.php(333): Illuminate\Database\Eloquent\Builder->get(Array)
#9 /app/vendor/laravel/framework/src/Illuminate/Database/Eloquent/Model.php(2047): Illuminate\Database\Eloquent\Builder->first()
#10 /app/vendor/laravel/framework/src/Illuminate/Routing/ImplicitRouteBinding.php(61): Illuminate\Database\Eloquent\Model->resolveRouteBinding('mcp', NULL)
#11 /app/vendor/laravel/framework/src/Illuminate/Routing/Router.php(959): Illuminate\Routing\ImplicitRouteBinding::resolveForRoute(Object(Illuminate\Foundation\Application), Object(Illuminate\Routing\Route))
#12 [internal function]: Illuminate\Routing\Router->{closure:Illuminate\Routing\Router::substituteImplicitBindings():959}(Object(Illuminate\Foundation\Application), Object(Illuminate\Routing\Route), Object(Closure))
#13 /app/vendor/laravel/framework/src/Illuminate/Routing/Router.php(961): call_user_func(Object(Closure), Object(Illuminate\Foundation\Application), Object(Illuminate\Routing\Route), Object(Closure))
#14 /app/vendor/laravel/framework/src/Illuminate/Routing/Middleware/SubstituteBindings.php(41): Illuminate\Routing\Router->substituteImplicitBindings(Object(Illuminate\Routing\Route))
#15 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Routing\Middleware\SubstituteBindings->handle(Object(Illuminate\Http\Request), Object(Closure))
#16 /app/app/Http/Middleware/Authenticate.php(22): Illuminate\Pipeline\Pipeline->{closure:{closure:Illuminate\Pipeline\Pipeline::carry():158}:159}(Object(Illuminate\Http\Request))
#17 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): App\Http\Middleware\Authenticate->handle(Object(Illuminate\Http\Request), Object(Closure))
#18 /app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php(78): Illuminate\Pipeline\Pipeline->{closure:{closure:Illuminate\Pipeline\Pipeline::carry():158}:159}(Object(Illuminate\Http\Request))
#19 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Foundation\Http\Middleware\VerifyCsrfToken->handle(Object(Illuminate\Http\Request), Object(Closure))
#20 /app/vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php(49): Illuminate\Pipeline\Pipeline->{closure:{closure:Illuminate\Pipeline\Pipeline::carry():158}:159}(Object(Illuminate\Http\Request))
#21 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\View\Middleware\ShareErrorsFromSession->handle(Object(Illuminate\Http\Request), Object(Closure))
#22 /app/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(121): Illuminate\Pipeline\Pipeline->{closure:{closure:Illuminate\Pipeline\Pipeline::carry():158}:159}(Object(Illuminate\Http\Request))
#23 /app/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(64): Illuminate\Session\Middleware\StartSession->handleStatefulRequest(Object(Illuminate\Http\Request), Object(Illuminate\Session\EncryptedStore), Object(Closure))
#24 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Session\Middleware\StartSession->handle(Object(Illuminate\Http\Request), Object(Closure))
#25 /app/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php(37): Illuminate\Pipeline\Pipeline->{closure:{closure:Illuminate\Pipeline\Pipeline::carry():158}:159}(Object(Illuminate\Http\Request))
#26 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse->handle(Object(Illuminate\Http\Request), Object(Closure))
#27 /app/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php(67): Illuminate\Pipeline\Pipeline->{closure:{closure:Illuminate\Pipeline\Pipeline::carry():158}:159}(Object(Illuminate\Http\Request))
#28 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(183): Illuminate\Cookie\Middleware\EncryptCookies->handle(Object(Illuminate\Http\Request), Object(Closure))
#29 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(119): Illuminate\Pipeline\Pipeline->{closure:{closure:Illuminate\Pipeline\Pipeline::carry():158}:159}(Object(Illuminate\Http\Request))
#30 /app/vendor/laravel/framework/src/Illuminate/Routing/Router.php(805): Illuminate\Pipeline\Pipeline->then(Object(Closure))
LinkAce version
v2.2.0
Setup Method
Docker
Operating System
Linux (Ubuntu, CentOS,...)
Client details
No response