[prev in list] [next in list] [prev in thread] [next in thread]
List: squirrelmail-cvs
Subject: [SM-CVS] SF.net SVN: squirrelmail:[14954] trunk/squirrelmail/functions/db_prefs.php
From: pdontthink--- via squirrelmail-cvs <squirrelmail-cvs () lists ! sourceforge ! net>
Date: 2022-05-22 18:55:29
Message-ID: 1653245729.967830.9503 () sfp-scm-1 ! v30 ! lw ! sourceforge ! com
[Download RAW message or body]
Revision: 14954
http://sourceforge.net/p/squirrelmail/code/14954
Author: pdontthink
Date: 2022-05-22 18:55:29 +0000 (Sun, 22 May 2022)
Log Message:
-----------
Implement SQL identifier quoting in all cases (alleviates issue double-quoting user \
field under PGSQL, #177)
Modified Paths:
--------------
trunk/squirrelmail/functions/db_prefs.php
Modified: trunk/squirrelmail/functions/db_prefs.php
===================================================================
--- trunk/squirrelmail/functions/db_prefs.php 2022-05-22 18:40:05 UTC (rev 14953)
+++ trunk/squirrelmail/functions/db_prefs.php 2022-05-22 18:55:29 UTC (rev 14954)
@@ -35,17 +35,17 @@
* internal database information from being
* exposed. This should be enabled only for
* debugging purposes.
- * string $pdo_identifier_quote_char By default, SquirrelMail will quote
- * table and field names in database
- * queries with what it thinks is the
- * appropriate quote character for the
- * database type being used (backtick
- * for MySQL (and thus MariaDB), double
- * quotes for all others), but you can
- * override the character used by
- * putting it here, or tell SquirrelMail
- * NOT to quote identifiers by setting
- * this to "none"
+ * string $db_identifier_quote_char By default, SquirrelMail will quote
+ * table and field names in database
+ * queries with what it thinks is the
+ * appropriate quote character for the
+ * database type being used (backtick
+ * for MySQL (and thus MariaDB), double
+ * quotes for all others), but you can
+ * override the character used by
+ * putting it here, or tell SquirrelMail
+ * NOT to quote identifiers by setting
+ * this to "none"
*
* @copyright 1999-2022 The SquirrelMail Project Team
* @license http://opensource.org/licenses/gpl-license.php GNU Public License
@@ -245,7 +245,7 @@
*
*/
function open() {
- global $prefs_dsn, $prefs_table, $use_pdo, $pdo_identifier_quote_char;
+ global $prefs_dsn, $prefs_table, $use_pdo, $db_identifier_quote_char;
global $prefs_user_field, $prefs_key_field, $prefs_val_field;
global $prefs_user_size, $prefs_key_size, $prefs_val_size;
@@ -268,16 +268,16 @@
$this->db_type = SMDB_PGSQL;
}
- // figure out identifier quoting (only used for PDO, though we could change \
that)
- if (empty($pdo_identifier_quote_char)) {
+ // figure out identifier quoting
+ if (empty($db_identifier_quote_char)) {
if ($this->db_type == SMDB_MYSQL)
$this->identifier_quote_char = '`';
else
$this->identifier_quote_char = '"';
- } else if ($pdo_identifier_quote_char === 'none')
+ } else if ($db_identifier_quote_char === 'none')
$this->identifier_quote_char = '';
else
- $this->identifier_quote_char = $pdo_identifier_quote_char;
+ $this->identifier_quote_char = $db_identifier_quote_char;
if (!empty($prefs_table)) {
$this->table = $prefs_table;
@@ -285,14 +285,6 @@
if (!empty($prefs_user_field)) {
$this->user_field = $prefs_user_field;
}
-
- // the default user field is "user", which in PostgreSQL
- // is an identifier and causes errors if not escaped
- //
- if ($this->db_type == SMDB_PGSQL) {
- $this->user_field = '"' . $this->user_field . '"';
- }
-
if (!empty($prefs_key_field)) {
$this->key_field = $prefs_key_field;
}
@@ -459,11 +451,17 @@
$this->failQuery();
}
} else {
- $query = sprintf("DELETE FROM %s WHERE %s='%s' AND %s='%s'",
+ $query = sprintf("DELETE FROM %s%s%s WHERE %s%s%s='%s' AND %s%s%s='%s'",
+ $this->identifier_quote_char,
$this->table,
+ $this->identifier_quote_char,
+ $this->identifier_quote_char,
$this->user_field,
+ $this->identifier_quote_char,
$this->dbh->quoteString($user),
+ $this->identifier_quote_char,
$this->key_field,
+ $this->identifier_quote_char,
$this->dbh->quoteString($key));
$res = $this->dbh->simpleQuery($query);
@@ -552,12 +550,20 @@
$this->failQuery();
}
} else {
- $query = sprintf("REPLACE INTO %s (%s, %s, %s) ".
+ $query = sprintf("REPLACE INTO %s%s%s (%s%s%s, %s%s%s, %s%s%s) ".
"VALUES('%s','%s','%s')",
+ $this->identifier_quote_char,
$this->table,
+ $this->identifier_quote_char,
+ $this->identifier_quote_char,
$this->user_field,
+ $this->identifier_quote_char,
+ $this->identifier_quote_char,
$this->key_field,
+ $this->identifier_quote_char,
+ $this->identifier_quote_char,
$this->val_field,
+ $this->identifier_quote_char,
$this->dbh->quoteString($user),
$this->dbh->quoteString($key),
$this->dbh->quoteString($value));
@@ -615,11 +621,17 @@
}
} else {
$this->dbh->simpleQuery("BEGIN TRANSACTION");
- $query = sprintf("DELETE FROM %s WHERE %s='%s' AND %s='%s'",
+ $query = sprintf("DELETE FROM %s%s%s WHERE %s%s%s='%s' AND \
%s%s%s='%s'", + $this->identifier_quote_char,
$this->table,
+ $this->identifier_quote_char,
+ $this->identifier_quote_char,
$this->user_field,
+ $this->identifier_quote_char,
$this->dbh->quoteString($user),
+ $this->identifier_quote_char,
$this->key_field,
+ $this->identifier_quote_char,
$this->dbh->quoteString($key));
$res = $this->dbh->simpleQuery($query);
if (DB::isError($res)) {
@@ -626,11 +638,19 @@
$this->dbh->simpleQuery("ROLLBACK TRANSACTION");
$this->failQuery($res);
}
- $query = sprintf("INSERT INTO %s (%s, %s, %s) VALUES ('%s', '%s', \
'%s')", + $query = sprintf("INSERT INTO %s%s%s (%s%s%s, %s%s%s, \
%s%s%s) VALUES ('%s', '%s', '%s')", + \
$this->identifier_quote_char, $this->table,
+ $this->identifier_quote_char,
+ $this->identifier_quote_char,
$this->user_field,
+ $this->identifier_quote_char,
+ $this->identifier_quote_char,
$this->key_field,
+ $this->identifier_quote_char,
+ $this->identifier_quote_char,
$this->val_field,
+ $this->identifier_quote_char,
$this->dbh->quoteString($user),
$this->dbh->quoteString($key),
$this->dbh->quoteString($value));
@@ -672,21 +692,35 @@
$this->failQuery();
}
} else {
- $query = sprintf("DELETE FROM %s WHERE %s='%s' AND %s='%s'",
+ $query = sprintf("DELETE FROM %s%s%s WHERE %s%s%s='%s' AND \
%s%s%s='%s'", + $this->identifier_quote_char,
$this->table,
+ $this->identifier_quote_char,
+ $this->identifier_quote_char,
$this->user_field,
+ $this->identifier_quote_char,
$this->dbh->quoteString($user),
+ $this->identifier_quote_char,
$this->key_field,
+ $this->identifier_quote_char,
$this->dbh->quoteString($key));
$res = $this->dbh->simpleQuery($query);
if (DB::isError($res)) {
$this->failQuery($res);
}
- $query = sprintf("INSERT INTO %s (%s, %s, %s) VALUES ('%s', '%s', \
'%s')", + $query = sprintf("INSERT INTO %s%s%s (%s%s%s, %s%s%s, \
%s%s%s) VALUES ('%s', '%s', '%s')", + \
$this->identifier_quote_char, $this->table,
+ $this->identifier_quote_char,
+ $this->identifier_quote_char,
$this->user_field,
+ $this->identifier_quote_char,
+ $this->identifier_quote_char,
$this->key_field,
+ $this->identifier_quote_char,
+ $this->identifier_quote_char,
$this->val_field,
+ $this->identifier_quote_char,
$this->dbh->quoteString($user),
$this->dbh->quoteString($key),
$this->dbh->quoteString($value));
@@ -736,12 +770,20 @@
$prefs_cache[$row['prefkey']] = $row['prefval'];
}
} else {
- $query = sprintf("SELECT %s as prefkey, %s as prefval FROM %s ".
- "WHERE %s = '%s'",
+ $query = sprintf("SELECT %s%s%s as prefkey, %s%s%s as prefval FROM \
%s%s%s ". + "WHERE %s%s%s = '%s'",
+ $this->identifier_quote_char,
$this->key_field,
+ $this->identifier_quote_char,
+ $this->identifier_quote_char,
$this->val_field,
+ $this->identifier_quote_char,
+ $this->identifier_quote_char,
$this->table,
+ $this->identifier_quote_char,
+ $this->identifier_quote_char,
$this->user_field,
+ $this->identifier_quote_char,
$this->dbh->quoteString($user));
$res = $this->dbh->query($query);
if (DB::isError($res)) {
This was sent by the SourceForge.net collaborative development platform, the world's \
largest Open Source development site.
-----
squirrelmail-cvs mailing list
List address: squirrelmail-cvs@lists.sourceforge.net
List info (subscribe/unsubscribe/change options): \
https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs
Repository: http://squirrelmail.org/svn
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic