get_new_username() does not escape string used in SQL call

[Evan Goldenberg]

Line 1217 in lib/user.php on master. The result of the call to substr is not escaped before being used in a SQL call. This means that if a user registers with a single quote in their name (such as Patty O'Furniture), a SQL error will be caused. This could allow someone to execute arbitrary SQL by specifying a name that begins with ';

A solution would be to use a placeholder in the offending SQL string.

Only affects Mahara 1.2 from the registration page, but the offending code is also used for xmlrpc functionality, which is present in earlier versions. In auth/xmlrpc/lib.php line 217 on master, if $remoteuser->username contained a single quote, the same problem would occur.

[Evan Goldenberg (naveg)]

The get_new_username() function is present from 1.0 onward.

[Evan Goldenberg (naveg)]

fixed on the security repo in branches master, 1.2_STABLE, 1.1_STABLE, 1.0_STABLE