unclecheese/Uploadify — pull request #39 by UndefinedOffset (2013-11-15 14:33:44+00:00)
Title: Potential SQL Injection In FileUploadField

It looks like Convert::raw2sql() is not enough for line 113 of FileUploadField, we received an error report from one of our monitored sites today emanating from FileUploadField that gave raised the concern.

Error: Couldn't run query: SELECT "File"."ClassName", "File"."Created", "File"."LastEdited", "File"."Name", "File"."Title", "File"."Filename", "File"."Content", "File"."Sort", "File"."ShowInSearch", "File"."SortOrder", "File"."ParentID", "File"."OwnerID", "File"."ID", CASE WHEN "File"."ClassName" IS NOT NULL THEN "File"."ClassName" ELSE 'File' END AS "RecordClassName" FROM "File" WHERE ("File"."ID" IN (8YEPUHjTwx)) ORDER BY "SortOrder" ASC Unknown column '8YEPUHjTwx' in 'where clause'