Copied to clipboard

Flag this post as spam?

This post will be reported to the moderators as potential spam to be looked at


  • Tobias Norén 2 posts 22 karma points
    Mar 14, 2014 @ 17:00
    Tobias Norén
    0

    Node can't be saved if text contains "select"

    Hi,

    Found a wierd thing that ought to be a bug.

    When writing a string containing the word "select" in a multiple row textbox, the node won't save as editContent.aspx will timeout.

    Must be due to some SQL injection problem...?

    Only tested in Umbraco 6.0.5.

    Regards,

    Tobias Norén

  • Jan Skovgaard 11280 posts 23678 karma points MVP 10x admin c-trib
    Mar 14, 2014 @ 19:56
    Jan Skovgaard
    0

    Hi Tobias and welcome to our :)

    Hmm, that seems like an odd issue. Not sure if it exists in other version (6.1.x and 7) but would it be possible for you to try and do a minor upgrade from 6.0.5 to 6.0.7, which can be downloaded from here http://our.umbraco.org/contribute/releases/607/ and see if the issue still exists?

    I will try to see if I can provoke this issue on version 6.1.6 and 7x...if it's a general issue then it should be reported as a bug at http://issues.umbraco.org/issues

    Oh and if you're not sure how to upgrade please read this documentation http://our.umbraco.org/documentation/Installation/Upgrading/ and of course remember to do a backup of both files and database first.

    Looking forward to hear from you. Hope this helps.

    /Jan

     

  • Jan Skovgaard 11280 posts 23678 karma points MVP 10x admin c-trib
    Mar 14, 2014 @ 20:07
    Jan Skovgaard
    0

    Hello again Tobias

    I have just tested clean installations of both v6.1.6 and v7.0.4 on a CE SQL database and I have tested both textstring and texboxes where I just write "select" without the quotes and it works just fine.

    Going to test the specific version next.

    /Jan

  • Jan Skovgaard 11280 posts 23678 karma points MVP 10x admin c-trib
    Mar 14, 2014 @ 20:16
    Jan Skovgaard
    0

    Ok I just tested a clean installation of Umbraco 6.0.5 the same way as mentioned above also running SQL CE and it saved just fine.

    I don't know much about databases so don't know if results would have been different if I had tested against MSSQL but I don't think so.

    What database are you using? And could you perhaps provide a screendump of the document where the "select" word is being used?

    Cheers,
    Jan 

  • Tobias Norén 2 posts 22 karma points
    Mar 15, 2014 @ 15:36
    Tobias Norén
    0

    Thanks for replies!

    Haven't upgraded yet, but I tried to reproduce it in 6.1.6 (another installation) and found no problem there.
    Kind of interesting to see what exacly is causing this...

    My original string where I discovered the issue was "Hess Select Chardonnay, Kalifornien, USA, 2012".

    (All string without the quotes.) 

    Looking more in to it I have only found the problem with the string "select char".

    "select" works.
    "char" works.
    "char test" works.
    "select cha" works.
    "select riesling" works. (Hehe.)
    "char select" works.
    "select test char" works.
    But "select char" does not work.
    Not "select chardonnay" or "reselect chardonnay" either.

    Gives the impression that it should have problems with SQL datatype words or something, but "select boolean" for example works.

    Tested in both the textstring and multiple textbox datatypes. Oh, and I'm using MSSQL. 


    Weird stuff, ey?

    /Tobias 

Please Sign in or register to post replies

Write your reply to:

Draft