hitoshura25/cvefixes huggingface dataset:
CVE-2020-14475 (PHP, published 2020-06-19T17:15Z)
Description: value: A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/public/notice.php
Commit message: Fix XSS reported by C. Weiler <sak1.s3curity@gmail.com> in notice.php

Vulnerable code:
    $langs->load("error");
    $langs->load("other");
    if (GETPOST('transphrase', 'alphanohtml')) print GETPOST('transphrase', 'alphanohtml');
    if (GETPOST('transkey', 'alphanohtml')) print $langs->trans(GETPOST('transkey', 'alphanohtml'));

Fixed code:
    $langs->loadLangs(array("error", "other"));
    if (GETPOST('transphrase', 'alphanohtml')) print dol_escape_htmltag(GETPOST('transphrase', 'alphanohtml'));
    elseif (GETPOST('transkey', 'alphanohtml')) print dol_escape_htmltag($langs->trans(GETPOST('transkey', 'alphanohtml')));
CVE-2020-35136 (PHP, published 2020-12-23T15:15Z)
Description: value: Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to admin/tools/dolibarr_export.php.
Severity: HIGH (CVSS v3 base score: 7.2)
Weakness: CWE-88 \u2014 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/admin/tools/export_files.php
htdocs/core/lib/functions.lib.php
test/phpunit/SecurityTest.php
Commit message: Fix disallow -- string into filename for security purpose. Vulnerability
reported by Yılmaz Değirmenci

Vulnerable code:
$compression = GETPOST('compression');
	$filesystem_forbidden_chars = array('<', '>', '/', '\\', '?', '*', '|', '"', ':', '°', '$', ';');
	return dol_string_nospecial($unaccent ?dol_string_unaccent($str) : $str, $newstr, $filesystem_forbidden_chars);
        $this->assertEquals($login, 'admin');

Fixed code:
$compression = GETPOST('compression', 'aZ09');
	// -- car can be used into filename to inject special paramaters like --use-compress-program to make command with file as parameter making remote execution of command
	$filesystem_forbidden_chars = array('<', '>', '/', '\\', '?', '*', '|', '"', ':', '°', '$', ';', '--');
	return dol_string_nospecial($unaccent ? dol_string_unaccent($str) : $str, $newstr, $filesystem_forbidden_chars);
        $this->assertEquals($login, 'admin', 'The test to check if pass of user "admin" is "admin" has failed');

    /**
     * testDolSanitizeFileName
     *
     * @return void
     */
    public function testDolSanitizeFileName()
    {
    	global $conf,$user,$langs,$db;
    	$conf=$this->savconf;
    	$user=$this->savuser;
    	$langs=$this->savlangs;
    	$db=$this->savdb;

    	//$dummyuser=new User($db);
    	//$result=restrictedArea($dummyuser,'societe');

    	$result=dol_sanitizeFileName('bad file | evilaction');
    	$this->assertEquals('bad file _ evilaction', $result);

    	$result=dol_sanitizeFileName('bad file --evilparam');
    	$this->assertEquals('bad file _evilparam', $result);
    }
CVE-2021-25954 (PHP, published 2021-08-09T17:15Z)
Description: value: In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at “/adherents/note.php?id=1” endpoint.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/core/actions_setnotes.inc.php
Commit message: Fix vulnerabiity: External users can set a public note

Vulnerable code:
} elseif ($action == 'setnote_private' && !empty($permissionnote) && !GETPOST('cancel', 'alpha')) {
	// Set public note
	if (empty($action) || !is_object($object) || empty($id)) {
		dol_print_error('', 'Include of actions_setnotes.inc.php was done but required variable was not set before');
	}
	if (empty($object->id)) {
		$object->fetch($id); // Fetch may not be already done
	}
	$result = $object->update_note(dol_html_entity_decode(GETPOST('note_private', 'restricthtml'), ENT_QUOTES | ENT_HTML5), '_private');
	if ($result < 0) {
		setEventMessages($object->error, $object->errors, 'errors');

Fixed code:
} elseif ($action == 'setnote_private' && !empty($permissionnote) && !GETPOST('cancel', 'alpha')) {	// Set public note
	if (empty($user->socid)) {
		// Private notes (always hidden to external users)
		if (empty($action) || !is_object($object) || empty($id)) {
			dol_print_error('', 'Include of actions_setnotes.inc.php was done but required variable was not set before');
		}
		if (empty($object->id)) {
			$object->fetch($id); // Fetch may not be already done
		}
		$result = $object->update_note(dol_html_entity_decode(GETPOST('note_private', 'restricthtml'), ENT_QUOTES | ENT_HTML5), '_private');
		if ($result < 0) {
			setEventMessages($object->error, $object->errors, 'errors');
		}
CVE-2021-25957 (PHP, published 2021-08-17T15:15Z)
Description: value: In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-640 \u2014 Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/user/passwordforgotten.php
Commit message: Fix report by Ahsan Aziz (can reset the password of another user that
did not request password reset).

Vulnerable code:
		$result = $edituser->fetch('', $_GET["username"]);
			if (dol_verifyHash($edituser->pass_temp.'-'.$edituser->id.'-'.$dolibarr_main_instance_unique_id, $passworduidhash)) {

Fixed code:
		$result = $edituser->fetch('', $username);
			if ($edituser->pass_temp && dol_verifyHash($edituser->pass_temp.'-'.$edituser->id.'-'.$dolibarr_main_instance_unique_id, $passworduidhash)) {
CVE-2021-36625 (PHP, published 2022-03-31T18:15Z)
Description: value: An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statement.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/compta/bank/class/account.class.php
htdocs/compta/sociales/class/cchargesociales.class.php
htdocs/societe/card.php
htdocs/societe/class/societe.class.php
Commit message: Fix sql injection

Vulnerable code:
		$sql .= ",state_id = ".($this->state_id > 0 ? $this->state_id : "null");
		$sql .= ",fk_pays = ".($this->country_id > 0 ? $this->country_id : "null");
		$sql .= ' deductible = '.(isset($this->deductible) ? $this->deductible : "null").',';
		$sql .= ' active = '.(isset($this->active) ? $this->active : "null").',';
		$sql .= ' fk_pays = '.(isset($this->fk_pays) ? $this->fk_pays : "null").',';
		$sql .= ' WHERE id='.$this->id;
				$object->country_id = GETPOST('country_id') != '' ?GETPOST('country_id') : $mysoc->country_id;
			$sql .= ", ".$this->status;
			$sql .= ",fk_departement = '".(!empty($this->state_id) ? $this->state_id : '0')."'";
			$sql .= ",fk_pays = '".(!empty($this->country_id) ? $this->country_id : '0')."'";
			$sql .= ", socialnetworks = '".$this->db->escape(json_encode($this->socialnetworks))."'";

Fixed code:
		$sql .= ",state_id = ".($this->state_id > 0 ? ((int) $this->state_id) : "null");
		$sql .= ",fk_pays = ".($this->country_id > 0 ? ((int) $this->country_id) : "null");
		$sql .= ' deductible = '.(isset($this->deductible) ? ((int) $this->deductible) : "null").',';
		$sql .= ' active = '.(isset($this->active) ? ((int) $this->active) : "null").',';
		$sql .= ' fk_pays = '.((isset($this->fk_pays) && $this->fk_pays > 0) ? ((int) $this->fk_pays) : "null").',';
		$sql .= ' WHERE id='.((int) $this->id);
				$object->country_id = GETPOST('country_id', 'int') != '' ? GETPOST('country_id', 'int') : $mysoc->country_id;
			$sql .= ", ".((int) $this->status);
			$sql .= ",fk_departement = ".((!empty($this->state_id) && $this->state_id > 0) ? ((int) $this->state_id) : 'null');
			$sql .= ",fk_pays = ".((!empty($this->country_id) && $this->country_id > 0) ? ((int) $this->country_id) : 'null');
			$sql .= ",socialnetworks = '".$this->db->escape(json_encode($this->socialnetworks))."'";
CVE-2021-37517 (PHP, published 2022-03-31T19:15Z)
Description: value: An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the application allows email addresses as usernames, which can cause a Denial of Service.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/user/card.php
htdocs/user/class/user.class.php
Commit message: Fix Improper Authorization Check reported by Ahsan Aziz.

Vulnerable code:
				if (GETPOST('password')) {
					$object->setPassword($user, GETPOST('password'));

Fixed code:
				if (GETPOST('password', 'none')) {
					$object->setPassword($user, GETPOST('password','none'));
		} elseif (preg_match('/[,@<>"\']/', $this->login)) {
		    $langs->load("errors");
		    $this->error = $langs->trans("ErrorBadCharIntoLoginName");
		    return -1;
		} elseif (preg_match('/[,@<>"\']/', $this->login)) {
		    $langs->load("errors");
		    $this->error = $langs->trans("ErrorBadCharIntoLoginName");
		    return -1;
CVE-2023-33568 (PHP, published 2023-06-13T15:15Z)
Description: value: An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-552 \u2014 Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/public/ticket/ajax/ajax.php
Commit message: FIX FILTER_VALIDATE_EMAIL param is not a string

Vulnerable code:
$email = GETPOST('email', 'custom', 0, 'FILTER_VALIDATE_EMAIL');

Fixed code:
$email = GETPOST('email', 'custom', 0, FILTER_VALIDATE_EMAIL);
CVE-2023-33568 (PHP, published 2023-06-13T15:15Z)
Description: value: An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-552 \u2014 Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/public/ticket/ajax/ajax.php
Commit message: Fix regression

Vulnerable code:
	httponly_accessforbidden('Module Ticket not enabled');
	httponly_accessforbidden('Option TICKET_CREATE_THIRD_PARTY_WITH_CONTACT_IF_NOT_EXIST of module ticket is not enabled');

Fixed code:

	accessforbidden('', 0, 0, 1);
	accessforbidden('', 0, 0, 1);
CVE-2023-4197 (PHP, published 2023-11-01T08:15Z)
Description: value: Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/core/lib/website.lib.php
test/phpunit/WebsiteTest.php
Commit message: FIX #CVE-2023-4197

Vulnerable code:

Fixed code:
	$str = str_replace('<?php', '__LTINTPHP__', $str);
	$str = str_replace('<?', '<?php', $str);			// replace the short_open_tag. It is recommended to set this is Off in php.ini
	$str = str_replace('__LTINTPHP__', '<?php', $str);

	/**
	 * testDolKeepOnlyPhpCode
	 *
	 * @return void
	 */
	public function testDolKeepOnlyPhpCode()
	{
		$s = 'HTML content <?php exec("eee"); ?> and more HTML content';
		$result = dolKeepOnlyPhpCode($s);
		print __METHOD__." result dolKeepOnlyPhpCode=".$result."\n";
		$this->assertEquals('<?php exec("eee"); ?>', $result, 'dolKeepOnlyPhpCode did extract the correct string');

		$s = 'HTML content <? exec("eee"); ?> and more HTML content';
		$result = dolKeepOnlyPhpCode($s);
		print __METHOD__." result dolKeepOnlyPhpCode=".$result."\n";
		$this->assertEquals('<?php exec("eee"); ?>', $result, 'dolKeepOnlyPhpCode did extract the correct string');

		$s = 'HTML content <?php test() <?php test2(); ?> and more HTML content';
		$result = dolKeepOnlyPhpCode($s);
		print __METHOD__." result dolKeepOnlyPhpCode=".$result."\n";
		$this->assertEquals('<?php test() ?><?php test2(); ?>', $result, 'dolKeepOnlyPhpCode did extract the correct string');
	}
CVE-2013-10014 (PHP, published 2023-01-19T10:15Z)
Description: value: A vulnerability classified as critical has been found in oktora24 2moons. Affected is an unknown function. The manipulation leads to sql injection. The patch is identified as 1b09cf7672eb85b5b0c8a4de321f7a4ad87b09a7. It is recommended to apply a patch to fix this issue. VDB-218898 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/oktora24/2moons
Files changed:
includes/pages/game/class.ShowFleetStep1Page.php
includes/pages/game/class.ShowFleetTablePage.php
includes/pages/game/class.ShowGalaxyPage.php
includes/pages/game/class.ShowInformationPage.php
Commit message: fix possible sql injections.

Vulnerable code:
		$targetGalaxy 			= HTTP::_GP('galaxy', $PLANET['galaxy']);
		$targetSystem 			= HTTP::_GP('system', $PLANET['system']);
		$targetPlanet			= HTTP::_GP('planet', $PLANET['planet']);
		$targetType 			= HTTP::_GP('type', $PLANET['planet_type']);
		$targetGalaxy	= HTTP::_GP('galaxy', $PLANET['galaxy']);
		$targetSystem	= HTTP::_GP('system', $PLANET['system']);
		$targetPlanet	= HTTP::_GP('planet', $PLANET['planet']);
		$targetType		= HTTP::_GP('planettype', $PLANET['planet_type']);
		$galaxy			= min(max(HTTP::_GP('galaxy', $PLANET['galaxy']), 1), Config::get('max_galaxy'));
		$system			= min(max(HTTP::_GP('system', $PLANET['system']), 1), Config::get('max_system'));
		$planet			= min(max(HTTP::_GP('planet', $PLANET['planet']), 1), Config::get('max_planets'));
			
		$TargetPlanet = HTTP::_GP('jmpto', $PLANET['id']);

Fixed code:
		$targetGalaxy 			= HTTP::_GP('galaxy', (int) $PLANET['galaxy']);
		$targetSystem 			= HTTP::_GP('system', (int) $PLANET['system']);
		$targetPlanet			= HTTP::_GP('planet', (int) $PLANET['planet']);
		$targetType 			= HTTP::_GP('type', (int) $PLANET['planet_type']);
		$targetGalaxy	= HTTP::_GP('galaxy', (int) $PLANET['galaxy']);
		$targetSystem	= HTTP::_GP('system', (int) $PLANET['system']);
		$targetPlanet	= HTTP::_GP('planet', (int) $PLANET['planet']);
		$targetType		= HTTP::_GP('planettype', (int) $PLANET['planet_type']);
		$galaxy			= min(max(HTTP::_GP('galaxy', (int) $PLANET['galaxy']), 1), Config::get('max_galaxy'));
		$system			= min(max(HTTP::_GP('system', (int) $PLANET['system']), 1), Config::get('max_system'));
		$planet			= min(max(HTTP::_GP('planet', (int) $PLANET['planet']), 1), Config::get('max_planets'));
		
		$TargetPlanet = HTTP::_GP('jmpto', (int) $PLANET['id']);
CVE-2023-31123 (Go, published 2023-05-08T21:15Z)
Description: value: `effectindex/tripreporter` is a community-powered, universal platform for submitting and analyzing trip reports. Prior to commit bd80ba833b9023d39ca22e29874296c8729dd53b, any user with an account on an instance of `effectindex/tripreporter`, e.g. `subjective.report`, may be affected by an improper password verification vulnerability. The vulnerability allows any user with a password matching the password requirements to log in as any user. This allows access to accounts / data loss of the user. This issue is patched in commit bd80ba833b9023d39ca22e29874296c8729dd53b. No action necessary for users of `subjective.report`, and anyone running their own instance should update to this commit or newer as soon as possible. As a workaround, someone running their own instance may apply the patch manually.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/effectindex/tripreporter
Files changed:
api/account.go
Commit message: api: (account) Fix improper password verification


Vulnerable code:
	account, err = a1.ValidatePassword(account.Password, "Password")

Fixed code:
	account, err = a1.VerifyPassword(account.Password)
CVE-2021-31873 (C, published 2021-04-30T06:15Z)
Description: value: An issue was discovered in klibc before 2.0.9. Additions in the malloc() function may result in an integer overflow and a subsequent heap buffer overflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/huolinjue/klibc
Files changed:
usr/klibc/malloc.c
Commit message: [klibc] malloc: Fail if requested size > PTRDIFF_MAX

malloc() adds some overhead to the requested size, which may result in
an integer overflow and subsequent buffer overflow if it is close to
SIZE_MAX.  It should fail if size is large enough for this to happen.

Further, it's not legal for a C object to be larger than
PTRDIFF_MAX (half of SIZE_MAX) as pointer arithmetic within it could
overflow.  So return failure immediately if size is greater than that.

CVE-2021-31873

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>


Vulnerable code:

Fixed code:
	/* Various additions below will overflow if size is close to
	   SIZE_MAX.  Further, it's not legal for a C object to be
	   larger than PTRDIFF_MAX (half of SIZE_MAX) as pointer
	   arithmetic within it could overflow. */
	if (size > PTRDIFF_MAX) {
		errno = ENOMEM;
		return NULL;
	}
CVE-2024-34062 (Unknown, published 2024-05-03T10:15Z)
Description: value: tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/tqdm/tqdm
Files changed:
Commit message: Merge pull request from GHSA-g7vv-2v7x-gj9p

cli: eval safety

Vulnerable code:

Fixed code:
CVE-2015-10056 (Other, published 2023-01-16T19:15Z)
Description: value: A vulnerability was found in 2071174A vinylmap. It has been classified as critical. Affected is the function contact of the file recordstoreapp/views.py. The manipulation leads to sql injection. The name of the patch is b07b79a1e92cc62574ba0492cce000ef4a7bd25f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218400.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/2071174A/vinylmap
Files changed:
README
recordstoreapp/views.py
Commit message: fixed SQL injection vuln in unsanitized search input

shame on you tony


Vulnerable code:
#TODO: unsanitized search input
	if 'q' in request.GET and request.GET['q'] != '':
		q = request.GET['q']
		cursor.execute("SELECT id,title,artist,cover FROM recordstoreapp_record WHERE title like '%" + q + "%' or artist like '%" + q + "%' or label like '%" + q + "%' or cat_no like '%" + q + "%';")

Fixed code:
	q = request.GET['q'].replace('%', '').replace('_', '').strip()
	if 'q' in request.GET and q != '':
		q = '%' + q + '%'
		cursor.execute("SELECT id,title,artist,cover FROM recordstoreapp_record WHERE title like %s or artist like %s or label like %s or cat_no like %s;", [q,q,q,q])