diff --git a/lib/NewsStats.pm b/lib/NewsStats.pm index 8a5dfde..f50ba94 100644 --- a/lib/NewsStats.pm +++ b/lib/NewsStats.pm @@ -642,9 +642,11 @@ sub SQLGroupList { ### OUT: SQL code to become part of a 'WHERE' clause, ### list of names for SQL bindings my ($Names,$Type) = @_; + my $InvalidCharRegExp; # substitute '*' wildcard with SQL wildcard character '%' $Names =~ s/\*/%/g; - return (undef,undef) if !CheckValidNames($Names); + $InvalidCharRegExp = ',;' if $Type eq 'client'; + return (undef,undef) if !CheckValidNames($Names,$InvalidCharRegExp); # just one name/newsgroup? return (SQLGroupWildcard($Names,$Type),$Names) if $Names !~ /:/; my ($SQL,@WildcardNames,@NoWildcardNames); @@ -807,10 +809,11 @@ sub SQLBuildClause { sub CheckValidNames { ################################################################################ ### syntax check of a list -### IN : $Names: list of names, e.g. newsgroups (group.one.*:group.two:group.three.*) +### IN : $Names : list of names, e.g. newsgroups (group.one.*:group.two:group.three.*) +### InvalidCharRegExp: regular expression for invalid characters ### OUT: boolean - my ($Names) = @_; - my $InvalidCharRegExp = ',; '; + my ($Names,$InvalidCharRegExp) = @_; + $InvalidCharRegExp = ',; ' if (!$InvalidCharRegExp); return ($Names =~ /[$InvalidCharRegExp]/) ? 0 : 1; };