[PATCH] SQL injection vulnerability patch for TracDownloads

[Aleksi Hanninen]

There is a SQL injection vulnerability in the Trac Downloads plugin.

Two patches are provided as attached:

1. tracdownloads_sql_injection_vulnerability.patch

2. tracdownloads_patch_complete.patch

Use the first "sql injection vulnerability" patch to fix the vulnerability. The patch also introduces fix in the download link resolver (link generation for download files in wiki context) by file.

A more complete, but unfortunately largely untested, "complete" patch contains the first "sql injection vulnerability" patch and also introduces other fixes, like:

• Editing just the description of the downloads won't crash. (If editing just the description of the downloads, you shouldn't expect any file to be uploaded)
• Since components should not use self.*, add a dict req_data and use that instead. This improves the security of concurrency.

Unfortunately, I haven't been able to test this with Vanilla trac, and I give no guarantees whatsoever. However, the first patch should work without problems.

My environment consists of Apache, Linux, Python 2.6, and Trac 0.12.1.

[Aleksi Hanninen]

I also changed import * to more specific versions and fixed some CSRF vulnerabilities in the "complete" patch.

[Ryan J Ollos]

#9609 closed as a duplicate.