Improper use of sqlite.execute allows arbitrary SQL

[daniel]

execute is improperly called in a few places (including auth.py), using array substitution directly, rather than allowing sqlite to handle quoting.

Example (from auth.py):

cursor.execute ("INSERT INTO auth_cookie (cookie, name, ipnr, time)" +
                "VALUES ('%s', '%s', '%s', %d)"
                % (cookie, req.remote_user, req.remote_addr, int(time.time())));

Should be:

cursor.execute ("INSERT INTO auth_cookie (cookie, name, ipnr, time)" +
                "VALUES ('%s', '%s', '%s', %d)",
                cookie, req.remote_user, req.remote_addr, int(time.time()));

<idnar> grep'ing the code shows a few possibly similar cases

[idnar]

Actually, the tokens shouldn't be quoted in the SQL statement; ie. it should be VALUES (%s, %s, %s, %d). I'm attaching a patch which I think fixes all of these (it hasn't been thoroughly tested, though).

[daniel]

Fixed in [712]. merged to stable in [713].