SQL Injection possibilities

[ischommer]

//ForumMemberProfile.php
function doregister($data, $form) {
		if($member = DataObject::get_one("Member","`Email` = '{$data['Email']}'")) {

$data isn't SQL-safe, you need to do

$SQL_data = Convert::raw2sql($data);

please check if there are other occurances of this problem :)

[mpeel]

email test

[sminnee]

Fixed in r45578, r45580, r45581, r45582

Markus - could you please note down the changesets that fixed an issue in the ticket comments :-). If you put an r at the front then it automatically becomes a link.

[mlanthaler]

Yes of course.. sorry I forgot that this time!