From 89be29505b1ed6146aef314d5524f46cc289cee3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=A1bor=20Hojtsy?= Date: Fri, 4 Jan 2008 09:31:49 +0000 Subject: #198856 by hswong3i: Fix some incorrect use of %s for table name escaping, implement better security checks --- modules/system/system.module | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'modules/system/system.module') diff --git a/modules/system/system.module b/modules/system/system.module index edf3a3bff..2431ef613 100644 --- a/modules/system/system.module +++ b/modules/system/system.module @@ -1213,7 +1213,7 @@ function system_cron() { db_query('DELETE FROM {batch} WHERE timestamp < %d', time() - 864000); // Remove temporary files that are older than DRUPAL_MAXIMUM_TEMP_FILE_AGE. - $result = db_query('SELECT * FROM {files} WHERE status = %s and timestamp < %d', FILE_STATUS_TEMPORARY, time() - DRUPAL_MAXIMUM_TEMP_FILE_AGE); + $result = db_query('SELECT * FROM {files} WHERE status = %d and timestamp < %d', FILE_STATUS_TEMPORARY, time() - DRUPAL_MAXIMUM_TEMP_FILE_AGE); while ($file = db_fetch_object($result)) { if (file_exists($file->filepath)) { // If files that exist cannot be deleted, continue so the database remains -- cgit v1.2.3