[PATCH 2/2] Added SQLite history plugin

[Bastian, Waldo]

> +    tmpparams = g_strdup_printf("\"%s\",%d,\"%s\",\"%s\",\"%s\",",
> +                    ofono_modem_get_path(context->modem),
> +                    msg_id, from, text, buf);
> +
> +    strftime(buf, 127, "\"%Y-%m-%dT%H:%M:%S%z\"", remote);
> +    buf[127] = '\0';
> +    params = g_strconcat(tmpparams, buf, NULL);
> +
> +    query = g_strdup_printf(INSERT_IN_MSGS, params);
[Snip]
> +    tmpparams = g_strdup_printf("\"%s\",%d,\"%s\",\"%s\",\"%s\",%d,",
> +                    ofono_modem_get_path(context->modem),
> +                    msg_id, to, text, buf,
> +                    OFONO_HISTORY_SMS_STATUS_PENDING);
> +
> +    currtime = time(NULL);
> +    strftime(buf, 127, "\"%Y-%m-%dT%H:%M:%S%z\"", localtime(&currtime));
> +    buf[127] = '\0';
> +    params = g_strconcat(tmpparams, buf, NULL);
> +
> +    query = g_strdup_printf(INSERT_OUT_MSGS, params);

The message handling in this patch seems to be vulnerable to SQL injection attacks. See http://en.wikipedia.org/wiki/SQL_injection

Cheers,
Waldo