Severity: HIGH
Location: src/Models/FileUpload.php:121-133 / src/Models/BbsListing.php:62-75
Bug: {$key} = :{$key} unquoted; latent SQL injection / mass-assignment if any caller passes user-controlled keys.
Fix: Per-model ALLOWED_COLUMNS whitelist, matching the pattern already in User::update.
Status: open. Will reply with remediation details when resolved.
Resolved.
Added ALLOWED_UPDATE_KEYS whitelists to both models:
src/Models/FileUpload.php::ALLOWED_UPDATE_KEYS = title, description, area_id, mime_type, file_size, download_count, tagssrc/Models/BbsListing.php::ALLOWED_UPDATE_KEYS = name, slug, description, telnet_host, telnet_port, terminal_type, ansi_preview, screenshot, sort_order, is_active, listing_typeAny key in $data that isn't on the whitelist now throws InvalidArgumentException. Column names are also backtick-quoted (`{$key}` = :{$key}) as defence in depth.
All existing callers only pass keys that are on the list. Test suite: 93/93 pass.
Locking this thread.
We noticed you are visiting from a mobile device. We are glad you are here, but know that 6502ish is best experienced on the desktop. Some features are not easily used via mobile and your experience may vary from the full experience via desktop.