Skip to content

T33502 - Fix YOURLS SQL injection

Afonso Cerejeira requested to merge afonso/T33502-fix-yourls-sql-injection into main

Since YOURLS v1.7.3 the SQL escaping function, yourls_escape is automatically called inside a SQL query as long as the query variables are passed as binds to the engine.

Ticket: https://phabricator.collabora.com/T33502 See: https://docs.yourls.org/development/database-queries.html#upgrade-your-code-for-1-7-3

This was tested locally by making sure that yourls keeps working and is shortening the URLs. Please let me know if there is any other testing needed for this. Tested with docker-compose.

Merge request reports

Loading