adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

[security] Email address containing apostrophe invalid due to magic quotes #160

New Issue
Closed
opened 2026-10-04 23:45:23 +02:00 by adam · 4 comments
adam commented 2026-10-04 23:45:23 +02:00
Owner
Copy link
Copy source

Reported by stim on 26 Apr 2011 11:42

Version: 2.2.1

When submitting an email address that contains an ' trough the profile page, the address is rejected because it is considered being wrongly formatted.
This is due to magic quotes changing (apo'strophe@example.com) into (apo'strophe@example.com).

Steps to reproduce: Change an email address of a user into one containing an '.

Piwigo Bugtracker #2282

**Reported by stim on 26 Apr 2011 11:42** **Version:** 2.2.1 When submitting an email address that contains an &#039; trough the profile page, the address is rejected because it is considered being wrongly formatted. This is due to magic quotes changing (apo&#039;strophe@example.com) into (apo&#039;strophe@example.com). **Steps to reproduce:** Change an email address of a user into one containing an &#039;. [Piwigo Bugtracker #2282](http://piwigo.org/bugs/view.php?id=2282) <!-- github-sync-id:97226259 -->
adam closed this issue 2026-10-04 23:45:23 +02:00
adam commented 2026-10-04 23:45:24 +02:00
Author
Owner
Copy link
Copy source

Comment posted by stim on 26 Apr 2011 11:43

(I don't really think it is necessary to allow ' in email addresses, but currently the program is not behaving like the contract (the regexp) says)

**Comment posted by stim on 26 Apr 2011 11:43** (I don&#039;t really think it is necessary to allow &#039; in email addresses, but currently the program is not behaving like the contract (the regexp) says) <!-- github-comment-id:124892312 -->
adam commented 2026-10-04 23:45:24 +02:00
Author
Owner
Copy link
Copy source

Comment posted by jcommelin on 2 May 2011 19:04

According to RFC 822 it is valid to have an apostrophe in ones email address. Still I think (just like stim) that it is not really necessary to allow them. It brings problems with it like SQL injections and such...

**Comment posted by jcommelin on 2 May 2011 19:04** According to RFC 822 it is valid to have an apostrophe in ones email address. Still I think (just like stim) that it is not really necessary to allow them. It brings problems with it like SQL injections and such... <!-- github-comment-id:124892322 -->
adam commented 2026-10-04 23:45:25 +02:00
Author
Owner
Copy link
Copy source

Comment posted by bryanw on 25 Sep 2014 20:26

Horrible attitude to take, and unfortunately it is pervasive through the Piwigo code.

Piwigo is attempting to be an internationally useful program. The fr.piwigo.org forums are full of complaints about errors in email and file names where apostrophe and accents are present.

Input sanitation is a basic thing. It is a solved problem. Automatically escaping URLs and email addresses is also a solved problem.

Basically, if my file system allows me to name a file "Robert'); DROP TABLE Students;--" then it should handle it. Observe that Mantis (the bug database) doesn't choke and die on accents and apostrophes.

**Comment posted by bryanw on 25 Sep 2014 20:26** Horrible attitude to take, and unfortunately it is pervasive through the Piwigo code. Piwigo is attempting to be an internationally useful program. The fr.piwigo.org forums are full of complaints about errors in email and file names where apostrophe and accents are present. Input sanitation is a basic thing. It is a solved problem. Automatically escaping URLs and email addresses is also a solved problem. Basically, if my file system allows me to name a file &quot;Robert&#039;); DROP TABLE Students;--&quot; then it should handle it. Observe that Mantis (the bug database) doesn&#039;t choke and die on accents and apostrophes. <!-- github-comment-id:124892335 -->
adam commented 2026-10-04 23:45:26 +02:00
Author
Owner
Copy link
Copy source

This issue might be useless, due to new validation system, based on filter_var.

This issue might be useless, due to new validation system, based on filter_var. <!-- github-comment-id:261235193 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#160