From 7dfd737d1389215622de711c147be436d4247daf Mon Sep 17 00:00:00 2001
From: einhverfr <einhverfr@4979c152-3d1c-0410-bac9-87ea11338e46>
Date: Sun, 16 Sep 2007 03:09:45 +0000
Subject: Correcting (trunk only) SQL injection issue in stored procedure
 interface.

git-svn-id: https://ledger-smb.svn.sourceforge.net/svnroot/ledger-smb/trunk@1615 4979c152-3d1c-0410-bac9-87ea11338e46
---
 LedgerSMB.pm | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'LedgerSMB.pm')

diff --git a/LedgerSMB.pm b/LedgerSMB.pm
index f61ae9a8..502b81e6 100755
--- a/LedgerSMB.pm
+++ b/LedgerSMB.pm
@@ -546,6 +546,9 @@ sub call_procedure {
     my $order_by = $args{order_by};
     my $argstr   = "";
     my @results;
+
+    $procname = $self->{dbh}->quote_identifier($procname);
+
     for ( 1 .. scalar @call_args ) {
         $argstr .= "?, ";
     }
-- 
cgit v1.2.3