Home Webmaster Fixed items with Swap Meet
Saturday, 18 May 2013
Main Menu
Public Service
Programs
Executive
Other
Blogs
Share on facebook
Fixed items with Swap Meet PDF Print E-mail
Written by Matt Zundel   
Friday, 31 December 2010 07:50

I discovered there were two problems with the Swap Meet section on the site.  The first was just some wording and the other was a potentially dangerous item.

Postal Code
The component was developed by an individual in the UK.  One item of carry over was the Postal Code -- He had it setup to accept UK postal codes only.  While I removed the code that restricted postal codes for the UK, I failed to remove the wording.  This wording has been removed and replaced with our standard postal code format: XXXXX or XXXXX-XXXX.

SQL Injection
There was a potential for an SQL injection on the site through the swap meet component.  I have added some extra code to parse any input from the browser to prevent SQL injection.  With a successful SQL injection, a malicious individual could read/write/delete any part of the database.  This was a good hole to have plugged.

Last Updated on Friday, 31 December 2010 08:21