|
|
|
|
|
|
by AlbertQQA
3354 days ago
|
|
|
All I'm seeing is a missing db_like which means a user can search for "%foo%bar%" instead of just "foo%bar". This is not a SQL-injection, nor a relevant issue. The problem is in that function though. It is missing a condition for publication status. Titles of unpublished nodes should render for some users, but not all. |
|
|